NtResumeThread
|
thread_handle:
0x00000190
suspend_count:
1
process_identifier:
2972
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
1684
thread_handle:
0x000002d0
process_identifier:
872
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\Windows\System32\cmd.exe
track:
1
command_line:
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp\jjroblox.exe" +s +h
filepath_r:
C:\Windows\System32\cmd.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
0
process_handle:
0x000002d8
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
1824
thread_handle:
0x000002d0
process_identifier:
1772
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\Windows\System32\cmd.exe
track:
1
command_line:
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
filepath_r:
C:\Windows\System32\cmd.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
0
process_handle:
0x000002c4
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
1332
thread_handle:
0x0000031c
process_identifier:
2256
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\Users\test22\AppData\Local\Temp\NJ.EXE
track:
1
command_line:
"C:\Users\test22\AppData\Local\Temp\NJ.EXE"
filepath_r:
C:\Users\test22\AppData\Local\Temp\NJ.EXE
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
0
process_handle:
0x00000328
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
1188
thread_handle:
0x00000314
process_identifier:
1472
current_directory:
filepath:
track:
1
command_line:
notepad
filepath_r:
stack_pivoted:
0
creation_flags:
134217728
(CREATE_NO_WINDOW)
inherit_handles:
0
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00010000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
kernel32.dll
base_address:
0x00010000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00020000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
user32.dll
base_address:
0x00020000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000b0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
Sleep
base_address:
0x000b0000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000c0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
MessageBoxA
base_address:
0x000c0000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000d0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
ExitThread
base_address:
0x000d0000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00120000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
DeleteFileA
base_address:
0x00120000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00130000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
GetLastError
base_address:
0x00130000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00140000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
TerminateProcess
base_address:
0x00140000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
CloseHandle
base_address:
0x00150000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00160000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
OpenProcess
base_address:
0x00160000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00170000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
GetExitCodeProcess
base_address:
0x00170000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001c0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
C:\Users\test22\AppData\Local\Temp\jjroblox.exe
base_address:
0x001c0000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00030000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
×Isu"suF@ Õ?wDTsuÀsuØtususuMtu
À
base_address:
0x00030000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
1472
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000318
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
UìSVW]C4PC,PÿPÿSCC8PC0PÿPÿSCC<PC,PÿPÿSCC@PC,PÿPÿSCCDPC,PÿPÿSCCHPC,PÿPÿSCCTPC,PÿPÿSC CLPC,PÿPÿSC$CPPC,PÿPÿSC(ëÿSøthô ÿSC\PÿSÀtåCXPj jÿS$ð
ötWVÿS(WVÿSVÿS j ÿS_^[] ÀUìÄ@ÿÿÿSV3ÉMôUøEüEüè
ùÿEøè
ùÿu3ÀUhfRG dÿ0d
Pÿÿÿ3ɺD èëøÿÇ
PÿÿÿD Ç
|ÿÿÿ fÇE
@ÿÿÿP
PÿÿÿPj j h j j j Eüè´ ùÿPj èp)ùÿ@ÿÿÿEüè.RùÿÀu
Eüº|RG èyùÿEøèRùÿÀu
Uø3ÀèÏ¡ùÿEôUøèXùÿºRG ÃèüüÿÿF,ºRG ÃèíüÿÿF0º RG ÃèÞüÿÿF4º¨RG ÃèÏüÿÿF8º´RG ÃèÀüÿÿF<ºÀRG Ãè±üÿÿF@ºÌRG Ãè¢üÿÿFDºÜRG ÃèüÿÿFHºðRG ÃèüÿÿFTºüRG ÃèuüÿÿFLºSG ÃèfüÿÿFPEôè¿ùÿÐÃèRüÿÿF\
HÿÿÿFXhSG h,SG èÇ)ùÿPèÉ)ùÿh8SG h,SG è°)ùÿPè²)ùÿFh RG h,SG è)ùÿPè)ùÿFh¨RG h,SG è)ùÿPè)ùÿFh´RG h,SG èh)ùÿPèj)ùÿFhÀRG h,SG èP)ùÿPèR)ùÿFhÌRG h,SG è8)ùÿPè:)ùÿFhÜRG h,SG è )ùÿPè")ùÿFhðRG h,SG è)ùÿPè
)ùÿF hüRG h,SG èð(ùÿPèò(ùÿF$hSG h,SG èØ(ùÿPèÚ(ùÿF(j`j κ´NG Ãèõûÿÿ3ÀZYYdhmRG Eôº èïùÿÃ
base_address:
0x001d0000
process_identifier:
1472
process_handle:
0x00000318
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
2040
thread_handle:
0x00000480
process_identifier:
2576
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
track:
1
command_line:
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
filepath_r:
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
0
process_handle:
0x0000048c
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
2888
thread_handle:
0x00000084
process_identifier:
1460
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\Windows\System32\attrib.exe
track:
1
command_line:
attrib "C:\Users\test22\AppData\Local\Temp\jjroblox.exe" +s +h
filepath_r:
C:\Windows\system32\attrib.exe
stack_pivoted:
0
creation_flags:
524288
(EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
1
process_handle:
0x00000088
|
1
|
1 |
0
|
CreateProcessInternalW
|
thread_identifier:
2856
thread_handle:
0x00000084
process_identifier:
556
current_directory:
C:\Users\test22\AppData\Local\Temp
filepath:
C:\Windows\System32\attrib.exe
track:
1
command_line:
attrib "C:\Users\test22\AppData\Local\Temp" +s +h
filepath_r:
C:\Windows\system32\attrib.exe
stack_pivoted:
0
creation_flags:
524288
(EXTENDED_STARTUPINFO_PRESENT)
inherit_handles:
1
process_handle:
0x00000088
|
1
|
1 |
0
|
NtResumeThread
|
thread_handle:
0x00000150
suspend_count:
1
process_identifier:
1472
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x0000018c
suspend_count:
1
process_identifier:
2576
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2768
thread_handle:
0x00000254
process_identifier:
2548
current_directory:
filepath:
track:
1
command_line:
notepad
filepath_r:
stack_pivoted:
0
creation_flags:
134217728
(CREATE_NO_WINDOW)
inherit_handles:
0
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000f0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
kernel32.dll
base_address:
0x000f0000
process_identifier:
2548
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00100000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
user32.dll
base_address:
0x00100000
process_identifier:
2548
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00110000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
Sleep
base_address:
0x00110000
process_identifier:
2548
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00120000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
MessageBoxA
base_address:
0x00120000
process_identifier:
2548
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00130000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|
WriteProcessMemory
|
buffer:
CreateProcessA
base_address:
0x00130000
process_identifier:
2548
process_handle:
0x00000258
|
1
|
1 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2548
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00140000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000258
|
1
|
0 |
0
|