Summary | ZeroBOX

ZXCXZCsssssssssssASDFasdfEWSDFew.exe

Generic Malware Code injection Socket Escalate priviledges Create Service KeyLogger DNS ScreenShot PE64 AntiDebug BitCoin PE File PE32 .NET EXE AntiVM
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 26, 2021, 8:27 a.m. Aug. 26, 2021, 8:29 a.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ca8ed36764b826bde1321643b68f439f
SHA256 24b35ddd2195133e968aeed816c92367a47413f58506138e75441446be1524de
CRC32 DF8AC7D2
ssdeep 49152:VsMx5jlN8T8AEPiKaNpr6tfepn8bh4S4YFuLM9:OMb8T8AAaNYt2hAfL
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
xmr.2miners.com 51.89.96.41
IP Address Status Action
164.124.101.2 Active Moloch
51.89.96.41 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: SUCCESS: The scheduled task "Runtlme" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

buffer: SUCCESS: The scheduled task "Runtlme" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000690000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000790000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1321000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef19bb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000810000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000008e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c66000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1908
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1976
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1976
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef105b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1976
region_size: 2555904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000024e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1976
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000026d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef09c2000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\xmr.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"'
file C:\Users\test22\AppData\Local\Temp\xmr.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\Runtlme.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\Runtlme.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 14
family: 0
111 0
section {u'size_of_data': u'0x00215400', u'virtual_address': u'0x00002000', u'entropy': 7.97730858090516, u'name': u'.text', u'virtual_size': u'0x00215304'} entropy 7.97730858091 description A section with a high entropy has been found
entropy 0.998829313978 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
url https://xmrig.com/wizard
url https://xmrig.com/benchmark/%s
url https://xmrig.com/docs/algorithms
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Perform crypto currency mining rule BitCoin
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Checks for the presence of known debug tools rule anti_dbgtools
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"'
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2972
region_size: 7745536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000458
1 0 0
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"'
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZÿÿ¸@0º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý›:º¹úTé¹úTé¹úTéâ’Pè¢úTéâ’Wè´úTéâ’QèqúTé'Z“é½úT鲕PèªúT鲕Wè°úT鲕Qè/úTé•Pè«úTéâ’Uè¬úTé¹úUéÓûTé<ŠPèêøTé•]èEúTé•Wè½úTé•«é¸úTé¹úÃé¸úTé•Vè¸úTéRich¹úTéPEd† Náað" ’4,A|2/@0v`ôrGܐu˜s¨ uЉ„ DÐ D(  D0°4x .textd4’4 `.rdatavæ°4è–4@@.dataS+ G~G@À.pdata¨s”H@@_RANDOMXV u¨J@`_SHA3_25@ 0u ¶J@`_TEXT_CNQ@u ÀJ@`_TEXT_CN„`uàJ@`_RDATA”€uòJ@@.rsrc˜uôJ@@.relocЉ uŠúJ@B
base_address: 0x0000000140000000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: H‹Ð%Àÿ HÁÊ âÀÿ ÄãûðÐ %Àÿ âÀÿ fffff„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅHÁÍ M3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ˆfD(5fD(=–H‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëdfffffff„fffffff„fffffff„€ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þА‹ÍáÀÿÿL3HÁÍ H3è‹ÕâÀÿÿL3LL3TL3\L3d L3l(L3t0L3|8HìÈH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$HÁÍ H3èH‹ÝHÁë&ãÿÿÿH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄÈH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0DSUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140752000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140753000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: à1ÿ1á1ï1(101@1P1è1€111 1h1°1Ð11®1«1×1§1´1Ä1Ô1¤1Ü1¸1ð1à1°1À1Ð1 1ø1
base_address: 0x0000000140758000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:  €8€P€h€ €  ux“u}x4VS_VERSION_INFO½ïþ?ØStringFileInfo´000004b0 CompanyNamedFileDescriptionWindows Configuration Manager,FileVersion2.0.0$LegalCopyright< OriginalFilenamexmrig.exe\ProductNameWindows Configuration Manager0ProductVersion2.0.0DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0000000140759000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: @
base_address: 0x000007fffffdc010
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZÿÿ¸@0º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý›:º¹úTé¹úTé¹úTéâ’Pè¢úTéâ’Wè´úTéâ’QèqúTé'Z“é½úT鲕PèªúT鲕Wè°úT鲕Qè/úTé•Pè«úTéâ’Uè¬úTé¹úUéÓûTé<ŠPèêøTé•]èEúTé•Wè½úTé•«é¸úTé¹úÃé¸úTé•Vè¸úTéRich¹úTéPEd† Náað" ’4,A|2/@0v`ôrGܐu˜s¨ uЉ„ DÐ D(  D0°4x .textd4’4 `.rdatavæ°4è–4@@.dataS+ G~G@À.pdata¨s”H@@_RANDOMXV u¨J@`_SHA3_25@ 0u ¶J@`_TEXT_CNQ@u ÀJ@`_TEXT_CN„`uàJ@`_RDATA”€uòJ@@.rsrc˜uôJ@@.relocЉ uŠúJ@B
base_address: 0x0000000140000000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0
Process injection Process 2260 called NtSetContextThread to modify thread in remote process 2972
Time & API Arguments Status Return Repeated

NtSetContextThread

registers.r14: 0
registers.r15: 0
registers.rcx: 5371802236
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1506920
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1998505216
registers.rdx: 8796092874752
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000045c
process_identifier: 2972
1 0 0
Process injection Process 2260 resumed a thread in remote process 2972
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000000000000045c
suspend_count: 1
process_identifier: 2972
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

information_class: 76 (SystemFirmwareTableInformation)
-1073741789 0
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 1908
1 0 0

NtResumeThread

thread_handle: 0x00000000000001dc
suspend_count: 1
process_identifier: 1908
1 0 0

CreateProcessInternalW

thread_identifier: 556
thread_handle: 0x0000000000000380
process_identifier: 1976
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\xmr.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\xmr.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\xmr.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000388
1 1 0

NtResumeThread

thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 1976
1 0 0

NtResumeThread

thread_handle: 0x0000000000000134
suspend_count: 1
process_identifier: 1976
1 0 0

NtResumeThread

thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 1976
1 0 0

NtResumeThread

thread_handle: 0x0000000000000200
suspend_count: 1
process_identifier: 1976
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000c8
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000c8
1 0 0

NtResumeThread

thread_handle: 0x00000000000000c8
suspend_count: 1
process_identifier: 1976
1 0 0

NtResumeThread

thread_handle: 0x0000000000000234
suspend_count: 1
process_identifier: 1976
1 0 0

CreateProcessInternalW

thread_identifier: 2684
thread_handle: 0x0000000000000388
process_identifier: 2832
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000390
1 1 0

NtResumeThread

thread_handle: 0x00000000000003b0
suspend_count: 1
process_identifier: 1976
1 0 0

CreateProcessInternalW

thread_identifier: 200
thread_handle: 0x000000000000040c
process_identifier: 2260
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\Runtlme.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\Runtlme.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\Runtlme.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000428
1 1 0

CreateProcessInternalW

thread_identifier: 2768
thread_handle: 0x0000000000000060
process_identifier: 2740
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2260
1 0 0

NtResumeThread

thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2260
1 0 0

NtResumeThread

thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2260
1 0 0

NtResumeThread

thread_handle: 0x0000000000000200
suspend_count: 1
process_identifier: 2260
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2260
1 0 0

NtResumeThread

thread_handle: 0x0000000000000234
suspend_count: 1
process_identifier: 2260
1 0 0

CreateProcessInternalW

thread_identifier: 2988
thread_handle: 0x000000000000038c
process_identifier: 2552
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000394
1 1 0

NtResumeThread

thread_handle: 0x0000000000000334
suspend_count: 1
process_identifier: 2260
1 0 0

CreateProcessInternalW

thread_identifier: 1632
thread_handle: 0x00000000000001f4
process_identifier: 1120
current_directory: C:\Users\test22\AppData\Roaming\Microsoft\Libs\
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000003f8
1 1 0

CreateProcessInternalW

thread_identifier: 620
thread_handle: 0x000000000000045c
process_identifier: 2972
current_directory: C:\Windows
filepath:
track: 1
command_line: C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr.2miners.com:12222 --user=49hcP786scM9nuVkefkNyFQ4arucjrM6U741zcbsVDUL9TTmmcLG57t9HG1QwKU7X95HYv3LWPP37GoHtmUY8THJHxfZxTs --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=100 --tls --cinit-stealth
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 1
process_handle: 0x0000000000000458
1 1 0

NtUnmapViewOfSection

base_address: 0x0000000140000000
region_size: 8786417680384
process_identifier: 2972
process_handle: 0x0000000000000458
-1073741799 0

NtAllocateVirtualMemory

process_identifier: 2972
region_size: 7745536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000458
1 0 0

WriteProcessMemory

buffer: MZÿÿ¸@0º´ Í!¸LÍ!This program cannot be run in DOS mode. $ý›:º¹úTé¹úTé¹úTéâ’Pè¢úTéâ’Wè´úTéâ’QèqúTé'Z“é½úT鲕PèªúT鲕Wè°úT鲕Qè/úTé•Pè«úTéâ’Uè¬úTé¹úUéÓûTé<ŠPèêøTé•]èEúTé•Wè½úTé•«é¸úTé¹úÃé¸úTé•Vè¸úTéRich¹úTéPEd† Náað" ’4,A|2/@0v`ôrGܐu˜s¨ uЉ„ DÐ D(  D0°4x .textd4’4 `.rdatavæ°4è–4@@.dataS+ G~G@À.pdata¨s”H@@_RANDOMXV u¨J@`_SHA3_25@ 0u ¶J@`_TEXT_CNQ@u ÀJ@`_TEXT_CN„`uàJ@`_RDATA”€uòJ@@.rsrc˜uôJ@@.relocЉ uŠúJ@B
base_address: 0x0000000140000000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x0000000140001000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

NtResumeThread

thread_handle: 0x0000000000000470
suspend_count: 1
process_identifier: 2260
1 0 0

WriteProcessMemory

buffer:
base_address: 0x000000014034b000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x000000014047a000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x0000000140730000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: H‹Ð%Àÿ HÁÊ âÀÿ ÄãûðÐ %Àÿ âÀÿ fffff„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅHÁÍ M3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ˆfD(5fD(=–H‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëdfffffff„fffffff„fffffff„€ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þА‹ÍáÀÿÿL3HÁÍ H3è‹ÕâÀÿÿL3LL3TL3\L3d L3l(L3t0L3|8HìÈH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$HÁÍ H3èH‹ÝHÁë&ãÿÿÿH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄÈH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0DSUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140752000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140753000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x0000000140754000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x0000000140756000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer: à1ÿ1á1ï1(101@1P1è1€111 1h1°1Ð11®1«1×1§1´1Ä1Ô1¤1Ü1¸1ð1à1°1À1Ð1 1ø1
base_address: 0x0000000140758000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:  €8€P€h€ €  ux“u}x4VS_VERSION_INFO½ïþ?ØStringFileInfo´000004b0 CompanyNamedFileDescriptionWindows Configuration Manager,FileVersion2.0.0$LegalCopyright< OriginalFilenamexmrig.exe\ProductNameWindows Configuration Manager0ProductVersion2.0.0DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0000000140759000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

WriteProcessMemory

buffer:
base_address: 0x000000014075a000
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

NtGetContextThread

thread_handle: 0x000000000000045c
1 0 0

WriteProcessMemory

buffer: @
base_address: 0x000007fffffdc010
process_identifier: 2972
process_handle: 0x0000000000000458
1 1 0

NtSetContextThread

registers.r14: 0
registers.r15: 0
registers.rcx: 5371802236
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1506920
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1998505216
registers.rdx: 8796092874752
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000045c
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x000000000000045c
suspend_count: 1
process_identifier: 2972
1 0 0

CreateProcessInternalW

thread_identifier: 2164
thread_handle: 0x0000000000000060
process_identifier: 2112
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "Runtlme" /tr '"C:\Users\test22\AppData\Local\Temp\Runtlme.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 1120
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Barys.50896
FireEye Generic.mg.ca8ed36764b826bd
McAfee GenericRXNP-BC!CA8ED36764B8
Sangfor Trojan.Win32.Save.a
Cybereason malicious.764b82
Cyren W32/Azorult.D.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/TrojanDropper.Agent.DPC
APEX Malicious
Kaspersky HEUR:Trojan.MSIL.Revenge.gen
BitDefender Gen:Variant.Barys.50896
Avast Win64:CoinminerX-gen [Trj]
Rising Trojan.FakeChrome!1.9C7B (CLASSIC)
Ad-Aware Gen:Variant.Barys.50896
Emsisoft Gen:Variant.Barys.50896 (B)
DrWeb Trojan.MulDrop9.43392
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
Sophos ML/PE-A + Mal/Behav-105
Ikarus Trojan-Dropper.MSIL.Agent
Microsoft Trojan:MSIL/AgentTesla.CHH!MTB
ZoneAlarm HEUR:Trojan.MSIL.Revenge.gen
GData Gen:Variant.Barys.50896
AhnLab-V3 Trojan/Win32.Agent.C2576300
BitDefenderTheta Gen:NN.ZemsilF.34104.fo0@aynOF4e
ALYac Gen:Variant.Barys.50896
MAX malware (ai score=82)
Malwarebytes MachineLearning/Anomalous.100%
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/CoinMiner.DMA!tr.dldr
AVG Win64:CoinminerX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_70% (D)