CreateProcessInternalW
|
thread_identifier:
2768
thread_handle:
0x000001ec
process_identifier:
2764
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\lzorhkapoykxd"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2764
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000360
process_identifier:
2764
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
2764
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
2764
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2828
thread_handle:
0x000001ec
process_identifier:
2824
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\wtukadkjcgccnuvi"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2824
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000350
process_identifier:
2824
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
356352
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4543032
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
2824
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
2824
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2892
thread_handle:
0x000001ec
process_identifier:
2888
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\yvzcbnvlqouhqajmfil"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2888
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x000001f0
process_identifier:
2888
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
2888
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
2888
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2988
thread_handle:
0x000001ec
process_identifier:
2984
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\deamgmaqrtq"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2984
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000364
process_identifier:
2984
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
2984
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
2984
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
3052
thread_handle:
0x000001ec
process_identifier:
3048
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\ngfxzflrnbisowy"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
3048
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000368
process_identifier:
3048
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
356352
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4543032
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
3048
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
3048
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2076
thread_handle:
0x000001ec
process_identifier:
2072
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\bQ6f.exe /stext "C:\Users\test22\AppData\Local\Temp\qbtqzxwlbjaxycmmqt"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000001e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001ec
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2072
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x0000036c
process_identifier:
2072
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x000001e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001ec
process_identifier:
2072
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001ec
suspend_count:
1
process_identifier:
2072
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
2764
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
2824
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
2984
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
3048
|
1
|
0 |
0
|