NtResumeThread
Aug. 20, 2021, 9:36 a.m.
thread_handle:
0x000000dc
suspend_count:
1
process_identifier:
2704
1
0
0
NtResumeThread
Aug. 20, 2021, 9:36 a.m.
thread_handle:
0x0000014c
suspend_count:
1
process_identifier:
2704
1
0
0
NtResumeThread
Aug. 20, 2021, 9:36 a.m.
thread_handle:
0x00000188
suspend_count:
1
process_identifier:
2704
1
0
0
NtResumeThread
Aug. 20, 2021, 9:37 a.m.
thread_handle:
0x00000260
suspend_count:
1
process_identifier:
2704
1
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
2608
thread_handle:
0x00000268
process_identifier:
2984
current_directory:
filepath:
C:\Users\test22\AppData\Local\Temp\HZUWUM5pprq6yKV.exe
track:
1
command_line:
filepath_r:
C:\Users\test22\AppData\Local\Temp\HZUWUM5pprq6yKV.exe
stack_pivoted:
0
creation_flags:
134217732
(CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x0000026c
1
1
0
NtGetContextThread
Aug. 20, 2021, 9:37 a.m.
thread_handle:
0x00000268
1
0
0
NtAllocateVirtualMemory
Aug. 20, 2021, 9:37 a.m.
process_identifier:
2984
region_size:
434176
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x0000026c
1
0
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ 2¢ycvÃ0vÃ0vÃ0b¨1xÃ0b¨1·Ã0¬ê0uÃ0$¶1dÃ0$¶1`Ã0$¶1=Ã0 ¶1Ã0b¨1aÃ0b¨1wÃ0b¨1gÃ0vÃ0ÒÃ0ö 1uÃ0ö1wÃ0RichvÃ0 PE L Àa à Ø ª = ð @ @ À0 ´ p t+ ¸ÿ 8 ðÿ @ ð P .text 8× Ø `.rdata N ð P Ü @ @.data 4- @ , @ À.reloc t+ p , L @ B
base_address:
0x00400000
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
base_address:
0x00401000
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
base_address:
0x0044f000
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
base_address:
0x00464000
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
base_address:
0x00467000
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
WriteProcessMemory
Aug. 20, 2021, 9:37 a.m.
buffer:
@
base_address:
0x7efde008
process_identifier:
2984
process_handle:
0x0000026c
1
1
0
NtSetContextThread
Aug. 20, 2021, 9:37 a.m.
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4341152
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000268
process_identifier:
2984
1
0
0
NtResumeThread
Aug. 20, 2021, 9:37 a.m.
thread_handle:
0x00000268
suspend_count:
1
process_identifier:
2984
1
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install2.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install2.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install3.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install3.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install4.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install4.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install5.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install5.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Aug. 20, 2021, 9:37 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
HZUWUM5pprq6yKV.exe