CreateProcessInternalW
June 29, 2021, 9:55 a.m.
thread_identifier:
5776
thread_handle:
0x00000040
process_identifier:
1836
current_directory:
filepath:
track:
1
command_line:
"C:\Users\test22\AppData\Local\Temp\idu9A98.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
0
()
inherit_handles:
1
process_handle:
0x00000044
1
1
0
CreateProcessInternalW
June 29, 2021, 9:55 a.m.
thread_identifier:
7144
thread_handle:
0x00000040
process_identifier:
7528
current_directory:
filepath:
track:
1
command_line:
"C:\Users\test22\AppData\Local\Temp\idu9A98.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000048
1
1
0
NtUnmapViewOfSection
June 29, 2021, 9:55 a.m.
base_address:
0x011b0000
region_size:
4096
process_identifier:
7528
process_handle:
0x00000048
1
0
0
NtAllocateVirtualMemory
June 29, 2021, 9:55 a.m.
process_identifier:
7528
region_size:
565248
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x011b0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000048
1
0
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
MZ ÿÿ ¸ @ à º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ YUjR 4 4 4L4 4^4Þ;Y 4Þ;[ 4Þ; 4Ïo 4Ïo 4Ïo 4Rich 4 PE L å"Ú` à b Ð @ 4 0 ð .text èa b `.rdata
f @ @.data ö ô p @ À.reloc 0 d @ B
base_address:
0x011b0000
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
base_address:
0x011b1000
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
h R , ú â Ê ® F : . â
ð
& 2 B P f z ¨ ¶ Ê Ü ì ü " & < N ^ l ~ ¶ Ê à ö v À
ª
v b
x
J .
`
T
ô ê à kernel32.dll CreateProcessW CreateProcessA advapi32.dll CreateProcessAsUserW CreateProcessAsUserA N T D L L . D L L LdrLoadDll LdrGetProcedureAddress NtProtectVirtualMemory NTDLL.DLL å"Ú`
è h C .text P ] .text$mn .idata$5 ì .rdata è .rdata$zzzdbg ø < .xdata$x 4 x .idata$2 ¬ .idata$3 À .idata$4 à ² .idata$6 ô .data .bss ÿÿÿÿ#6@ )6@ ÿÿÿÿ´b@ Äb@ ÿÿÿÿ¸]@ È]@ ÿÿÿÿ V@ 7V@ ¼ J
ü ¤
ä Ø
Ì À < ´ V ô Ø h R , ú â Ê ® F : . â
ð
& 2 B P f z ¨ ¶ Ê Ü ì ü " & < N ^ l ~ ¶ Ê à ö v À
ª
v b
x
J .
`
T
ô ê à Hmemset Fmemcpy NtUnmapViewOfSection àZwClose RtlNtStatusToDosError iZwQueryInformationProcess ntdll.dll RtlUnwind 5NtQueryVirtualMemory : PathCombineW 6StrRChrA StrChrA SHLWAPI.dll EnumProcessModules GetModuleFileNameExA PSAPI.DLL DLocalAlloc KLocalReAlloc HLocalFree %WriteFile R CloseHandle NlstrlenW CreateEventA tOpenEventA GetModuleFileNameW GetModuleHandleA ¨ CreateProcessW ExpandEnvironmentStringsW CreateFileW GetComputerNameW ¼SwitchToThread GetLastError ResumeThread ²Sleep GetModuleHandleW ¢GetVersion ÁGetCurrentProcessId EGetProcAddress éVirtualAlloc ìVirtualFree êVirtualAllocEx OpenProcess ÀGetCurrentProcess © CreateRemoteThread ÃReadProcessMemory .WriteProcessMemory ùWaitForSingleObject ðGetFileSize ÀReadFile fSetFilePointer DlstrcmpiA GlstrcpyA >lstrcatA MlstrlenA GetModuleFileNameA CreateFileA WMapViewOfFile CreateFileMappingW ïVirtualProtect âInitializeCriticalSection î EnterCriticalSection 9LeaveCriticalSection Ñ DeleteCriticalSection AlstrcmpA bFreeLibrary <LoadLibraryA KERNEL32.dll 2wsprintfA USER32.dll à SHGetFolderPathW ShellExecuteA SHELL32.dll
base_address:
0x011b8000
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
base_address:
0x011b9000
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ä 1s1ã1ý12¡2¶2ò233+3?3Ô3à3í34*414[4y44´4Ì4Ö45Ý56.6T6b6v66Ù6ã6·7ò7ü7 88)8/8N8k8
88£8³8Ç8þ89G9d9v9~9¿9Ü9þ9:$:Q:v:£:Ç:Ì:í:;?;l;³;Õ;ã;4<`<k<u<<Å<ä<õ<= =6=G=L=R=e=j=
==«=°=·=¼=â=>>}>>>>ª>å>? ?)?k??¬?¼? 10:0K0Q0\00®0¶0Ü0611¤1û12:2C2K2Q2X2^2h2n2y2222£2¬2³2À2É2Ô2í2ö2þ23 333 31393@3Q3Y3`3q3y33Â3Ø3ð3¥5«5Ø5Þ5 66ï6õ677!7B7H7:]:q:¾:É:
; ;<û<=I=R=d=w=~=¡=©=®=¼=Á=Ï=Ô=Û=î=÷=> >D>z>>>>¤>ª>³>å>ï>÷>?
??"?,?5?<?^?d?p?~????¢?¨?®?·?¼?Í?Ó?Ù?ß?ê?ø? 0 ¸ 0¯0ê0 1
1O1z1¤1¬1ø1ý1I2í2\3¬346455u5N6æ67 7977Ù748I8P8`8n8u888 8°8¾8Å8/9T99¾9
;1;?;¢;¬;Í;Õ;Ú;à;ç;ì;ò; <#<><U<]<b<h<o<t<z<<¼<Ö<=b=u=³=Ù=á=
>>I>P>â>è> ?%?*?0?J?R??¤? @ Ð 0 0V2A33¦3ç3î344ô4ú4,525I5`5f55646x6ì67'727A7\77ñ78v88µ89:0:®:´:ó:;T;t;;¾;Õ;ß;ú; <p<¤<·<¿<F=\=v=|==£=©=¶=Ð=Ö=ã=ý=>>*>0>=>W>]>j>>>>±>·>Ä>Þ>ä>ñ> ?? ?8?>?K?e?k?x???¢?¹?¾?Õ?Ú?ñ?ö? P
00)0.0E0J0a0f0}0000µ0º0Ñ0Ö0í0ò0 111±1Ð1ß1û1
2!202U2e2A3G3x33333Å3â3ë3ô3ý3 4&4+4Ð4555»56s7E8ô8ú8{99î9ô92:m:¶;»;7<½<=5=R== >>¬>ã>í>F? ` ¶0Ý0é0 111262K22¤2·3Á3$4*444:4@4D4I4N4d4j4t4z44444 4¤4©4®4Ä4Ê4Ô4Ú4û4¹5779Â<=ÿ=> >$>+>[>h>n>¼> ?9?>?D?K?t?ç?í? p X0Ç0Í0à0Æ1Ì1Ò1Ø1Þ1ä1 ü2 3 33 3 3,303 p \ ; ;; ;(;0;<;D;L;X;`;h;t;|;;;; ;´;¼;Ð;Ø;ì;ô;<< <(<4<@<L<X<d<p<|<<< <¬<¸<Ä<Ð< @3D3H3
base_address:
0x01239000
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
$ÿuè
base_address:
0x011b1118
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
,dÿ5
base_address:
0x011b1173
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
,uQ
base_address:
0x011b11e3
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ð#ë
SQ
base_address:
0x011b11fd
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ð#M
base_address:
0x011b1206
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
h
#óæ
base_address:
0x011b12a1
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
p
#t+@;
base_address:
0x011b12b6
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
°
#Bû
base_address:
0x011b12f2
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
p
#t*A
base_address:
0x011b1306
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
p
#tHy
base_address:
0x011b1316
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
h
#Aÿë
base_address:
0x011b132b
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
p
#9B;
base_address:
0x011b133f
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
°
#
É
base_address:
0x011b13d4
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
h
#
ÉÑ
base_address:
0x011b13e0
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
l
#90t
base_address:
0x011b13ed
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
p
#8B;
base_address:
0x011b1413
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
h
#3À¹°
base_address:
0x011b142a
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
°
#é&
base_address:
0x011b1431
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
<]Â
base_address:
0x011b145b
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
D]Â
base_address:
0x011b1479
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
@]Â
base_address:
0x011b149f
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
M
base_address:
0x011b14b4
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
d#àt
base_address:
0x011b14cc
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
M
base_address:
0x011b14d6
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
`Pèp
base_address:
0x011b1516
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
Ü
À
base_address:
0x011b15dd
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
z#ý
base_address:
0x011b161a
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ìEèP
base_address:
0x011b162e
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
dEü
base_address:
0x011b1654
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
´z#
ý
base_address:
0x011b1662
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ìUèR
base_address:
0x011b1676
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
dEü
base_address:
0x011b169c
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
LUèR
base_address:
0x011b16d9
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
Ljèb
base_address:
0x011b16e3
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
pUÜR
base_address:
0x011b17b7
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
Ôz#UðR
base_address:
0x011b17f2
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ôÄ
base_address:
0x011b17fc
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
Øz#MðQ
base_address:
0x011b180b
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
ôÄ h
base_address:
0x011b1815
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
Üz#ÿh
base_address:
0x011b1829
process_identifier:
7528
process_handle:
0x00000048
1
1
0
WriteProcessMemory
June 29, 2021, 9:55 a.m.
buffer:
hj h
base_address:
0x011b182f
process_identifier:
7528
process_handle:
0x00000048
1
1
0
idu9A98.exe