NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000dc
suspend_count:
1
process_identifier:
1092
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x00000150
suspend_count:
1
process_identifier:
1092
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x00000190
suspend_count:
1
process_identifier:
1092
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000002b0
suspend_count:
1
process_identifier:
1092
1
0
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
1
0
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
1
0
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
1
0
0
NtSetContextThread
Sept. 1, 2021, 9:32 a.m.
registers.eip:
1931619204
registers.esp:
4051604
registers.edi:
4051780
registers.eax:
13853783
registers.ebp:
4051824
registers.edx:
5
registers.ebx:
0
registers.esi:
0
registers.ecx:
38
thread_handle:
0x000000e0
process_identifier:
1092
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
suspend_count:
1
process_identifier:
1092
1
0
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
1
0
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000000e0
suspend_count:
1
process_identifier:
1092
1
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
2316
thread_handle:
0x000002b8
process_identifier:
2320
current_directory:
filepath:
C:\Users\test22\AppData\Local\Temp\system32.exe
track:
1
command_line:
filepath_r:
C:\Users\test22\AppData\Local\Temp\system32.exe
stack_pivoted:
0
creation_flags:
134217732
(CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002bc
1
1
0
NtGetContextThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000002b8
1
0
0
NtAllocateVirtualMemory
Sept. 1, 2021, 9:32 a.m.
process_identifier:
2320
region_size:
434176
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x000002bc
1
0
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ 2¢ycvÃ0vÃ0vÃ0b¨1xÃ0b¨1·Ã0¬ê0uÃ0$¶1dÃ0$¶1`Ã0$¶1=Ã0 ¶1Ã0b¨1aÃ0b¨1wÃ0b¨1gÃ0vÃ0ÒÃ0ö 1uÃ0ö1wÃ0RichvÃ0 PE L X.a à Ø ª = ð @ @ À0 ´ p t+ Àÿ 8 øÿ @ ð P .text 8× Ø `.rdata N ð P Ü @ @.data 4- @ , @ À.reloc t+ p , L @ B
base_address:
0x00400000
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
base_address:
0x00401000
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
base_address:
0x0044f000
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
base_address:
0x00464000
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
base_address:
0x00467000
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
WriteProcessMemory
Sept. 1, 2021, 9:32 a.m.
buffer:
@
base_address:
0x7efde008
process_identifier:
2320
process_handle:
0x000002bc
1
1
0
NtSetContextThread
Sept. 1, 2021, 9:32 a.m.
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4341152
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000002b8
process_identifier:
2320
1
0
0
NtResumeThread
Sept. 1, 2021, 9:32 a.m.
thread_handle:
0x000002b8
suspend_count:
1
process_identifier:
2320
1
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install2.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install2.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install3.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install3.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install4.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install4.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\install5.exe
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\install5.exe
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:32 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:33 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Systemd\
track:
0
command_line:
filepath_r:
C:\ProgramData\Systemd\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
CreateProcessInternalW
Sept. 1, 2021, 9:33 a.m.
thread_identifier:
0
thread_handle:
0x00000000
process_identifier:
0
current_directory:
filepath:
C:\ProgramData\Data\
track:
0
command_line:
filepath_r:
C:\ProgramData\Data\
stack_pivoted:
0
creation_flags:
8
(DETACHED_PROCESS)
inherit_handles:
0
process_handle:
0x00000000
0
0
system32.exe