CreateProcessInternalW
|
thread_identifier:
2760
thread_handle:
0x000001c4
process_identifier:
2756
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\fcczemupolqwdnhtanj"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002d0
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c4
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2756
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x0000034c
process_identifier:
2756
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c4
process_identifier:
2756
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c4
suspend_count:
1
process_identifier:
2756
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2820
thread_handle:
0x000001c4
process_identifier:
2816
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\hwhsffejctibntexryvfse"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002d0
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c4
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2816
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000350
process_identifier:
2816
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
356352
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4543032
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c4
process_identifier:
2816
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c4
suspend_count:
1
process_identifier:
2816
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2884
thread_handle:
0x000001c4
process_identifier:
2880
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\rznkgxplqbaophsbaiqhcrucke"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002d0
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c4
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2880
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000354
process_identifier:
2880
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x000002d0
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c4
process_identifier:
2880
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c4
suspend_count:
1
process_identifier:
2880
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
3012
thread_handle:
0x00000334
process_identifier:
3008
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\wioudwuqzfxmmokll"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001c4
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000334
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
3008
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x0000035c
process_identifier:
3008
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000334
process_identifier:
3008
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000334
suspend_count:
1
process_identifier:
3008
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2052
thread_handle:
0x00000334
process_identifier:
3068
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\zkbfehfrnnprougxuqdvg"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001c4
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000334
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
3068
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000360
process_identifier:
3068
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
356352
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4543032
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000334
process_identifier:
3068
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000334
suspend_count:
1
process_identifier:
3068
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
1384
thread_handle:
0x00000334
process_identifier:
2088
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\WUDFHost.exe /stext "C:\Users\test22\AppData\Local\Temp\jegxezqlbwheyjublbqwjwpt"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001c4
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000334
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2088
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000364
process_identifier:
2088
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x000001c4
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000334
process_identifier:
2088
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000334
suspend_count:
1
process_identifier:
2088
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
2756
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
2816
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
3008
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
3068
|
1
|
0 |
0
|