popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

skx3hHI.exe

.NET framework(MSIL) Socket DNS persistence AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 19, 2023, 6:27 p.m. Oct. 19, 2023, 6:36 p.m.
Size 329.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 aa97e84ddfed87f96092e40ae29e9a63
SHA256 3d1d747d644420a2bdc07207b29a0509531e22eb0b1eedcd052f85085bef6865
CRC32 2C5732AD
ssdeep 6144:J5TwVXXB9bnsa1hp1usSnoFSRvrv0DqK3cSs6myXJ0UDaqwSFH:J50JR9oa1h6noEVv0xH56ULwSF
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
94.156.6.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006b1868
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006b18e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006b18e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00450000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00282000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0028a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0028c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005df000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00491000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c59000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 38400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05340400
process_handle: 0xffffffff
3221225550 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1208
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05340178
process_handle: 0xffffffff
3221225550 0

NtProtectVirtualMemory

 process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x053401a0
process_handle: 0xffffffff
3221225550 0
section {u'size_of_data': u'0x00051e00', u'virtual_address': u'0x00002000', u'entropy': 7.689931231497998, u'name': u'.text', u'virtual_size': u'0x00051db4'} entropy 7.6899312315 description A section with a high entropy has been found
entropy 0.995440729483 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Install itself for autorun at Windows startup rule Persistence
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2152
process_handle: 0x00000460
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2152
process_handle: 0x00000460
1 0 0
host 94.156.6.14
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2240
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000470
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0x00000470
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description skx3hHI.exe tried to sleep 2728237 seconds, actually delayed analysis time by 2728237 seconds
Process injection Process 1208 manipulating memory of non-child process 2152
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
1 0 0

NtProtectVirtualMemory

 process_identifier: 2152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 1 (PAGE_NOACCESS)
base_address: 0x00400000
process_handle: 0x0000045c
3221225517 0
Process injection Process 1208 injected into non-child 2152
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x000a0000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x000a4000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x000a5000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x000a6000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x7efde008
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x00404000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x00405000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x00406000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2240
process_handle: 0x00000470
1 1 0
Process injection Process 1208 injected into non-child 2152
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x000a0000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2240
process_handle: 0x00000470
1 1 0
Process injection Process 1208 called NtSetContextThread to modify thread in remote process 2240
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4198400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000046c
process_identifier: 2240
1 0 0
file C:\Users\test22\AppData\Local\Temp\skx3hHI.exe\:Zone.Identifier
Process injection Process 1208 resumed a thread in remote process 2240
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000046c
suspend_count: 1
process_identifier: 2240
1 0 0
FireEye Generic.mg.aa97e84ddfed87f9
Skyhigh BehavesLike.Win32.Generic.fc
McAfee Artemis!AA97E84DDFED
Cylance unsafe
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilF.36738.um0@aiDnbPn
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.AJXI
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:Trojan.MSIL.Crypt.gen
Avast Win32:TrojanX-gen [Trj]
Trapmine malicious.high.ml.score
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
Varist W32/MSIL_Kryptik.DSR.gen!Eldorado
Kingsoft malware.kb.c.1000
Microsoft Program:Win32/Wacapew.C!ml
ZoneAlarm UDS:Trojan.MSIL.Crypt.gen
Google Detected
Malwarebytes Malware.AI.991493986
Rising Malware.Obfus/MSIL@AI.89 (RDM.MSIL2:Mvya73ovJTsepqxNyqoWBA)
Ikarus Trojan.MSIL.Crypt
Fortinet MSIL/Kryptik.AJMF!tr
AVG Win32:TrojanX-gen [Trj]
Cybereason malicious.ee0183
DeepInstinct MALICIOUS
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x000003f8
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x0000041c
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x00000430
suspend_count: 1
process_identifier: 1208
1 0 0

NtResumeThread

 thread_handle: 0x00000444
suspend_count: 1
process_identifier: 1208
1 0 0

CreateProcessInternalW

 thread_identifier: 2156
thread_handle: 0x00000458
process_identifier: 2152
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\skx3hHI.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\skx3hHI.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\skx3hHI.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000045c
1 1 0

NtGetContextThread

 thread_handle: 0x00000458
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2152
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000045c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x000a0000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000a1000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x000a4000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x000a5000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x000a6000
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x7efde008
process_identifier: 2152
process_handle: 0x0000045c
1 1 0

CreateProcessInternalW

 thread_identifier: 2244
thread_handle: 0x0000046c
process_identifier: 2240
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\skx3hHI.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\skx3hHI.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\skx3hHI.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000470
1 1 0

NtGetContextThread

 thread_handle: 0x0000046c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2240
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000470
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $UÉ;¨th¨th¨thŸ·ghm¨thíˆfh¨thRich¨thPELÆɅdà  (@@pDA `@D.text–&( `.rdataF@ ,@@.data@P6@À.relocr`:@B
base_address: 0x00400000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFF¬BêCÈ@B–E$@äA8F@ðBØF AàBGü@pBPGŒ@€B:Hœ@FºEÐEäE&F¤EFòEtEŠE$EfEöCDD"D2DBDPDhDzDŽDžD´DÈDØDðDþD EEVE6E>E>G.GGÞGZGvGˆG G²GÆGðG HHnC|CˆCšC¬CºCÎCÞC(C`CLC:CðFäFGTFbFtF€FŒFšF¢F¬F´FÂFÎFlFFFVCreateWindowExAƒDefWindowProcA“DispatchMessageA"GetMessageA”LoadCursorA˜LoadIconAÕPostQuitMessageàRegisterClassAHShowWindow^TranslateMessagejUpdateWindow}wsprintfAuser32.dll#CloseHandle9CreateEventA=CreateFileAJCreateMutexAVCreateThread›ExitProcess¤FileTimeToSystemTimeæGetCommandLineAGetCurrentProcess)GetLocalTime2GetModuleFileNameA4GetModuleHandleA„GetTempPathA˜GetVolumeInformationAðLocalAllocôLocalFreeOpenMutexA€SetEvent…SetFilePointer·Sleep¼SystemTimeToFileTimeÙVirtualAllocÛVirtualFreeèWaitForSingleObject÷WriteFilekernel32.dllGetSidSubAuthorityGetTokenInformation˜OpenProcessToken·RegCloseKey»RegCreateKeyExAÀRegDeleteValueAÐRegOpenKeyExAçRegSetValueExAadvapi32.dll!WSAStartup&closesocket'connect5htons6inet_addr8inet_ntoa9ioctlsocket>recvCselectDsendGsetsockoptHshutdownIsocketwsock32.dll(WSAIoctlWfreeaddrinfoXgetaddrinfows2_32.dllCoCreateInstance8CoInitializedCoUninitializeole32.dllAcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessageFreeContextBufferFreeCredentialsHandleGetUserNameExAGetUserNameExWInitializeSecurityContextA*QueryContextAttributesAsecur32.dll
base_address: 0x00404000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: ™£q(¤‚ùL”¼ ÎAQg„§Þ€+•#Ž†÷öØ»¨u¸noÛæ6aêƸÕ¼CU6k üÔâ® ó â«Ô§ªBŠ[rn3ynÛæ6aêƸÕ¼CU6k üÔªá_§»âšØð€!‰T"3)5oÛæ6aêƸÕ¼CU6k üÔªá_§»âšØ ÂÒu¸no­üà<socks5Software\Microsoft\Windows\CurrentVersion\Runwin32appMicrosoftpowershell.exe -windowstyle hidden -Command "& '%s'"*Ջ«¢Î±ªS'Ջ«¢Î±ªS$Ջ«¢Î±ªS Ջ«¢Î±ªS ÀFGET %s HTTP/1.0 Host: %s User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close Microsoft Unified Security Protocol Provider
base_address: 0x00405000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: D000"0O0T0k0¶0ï0ô0+3<3a3r3ë3ü3G4ø5+6Ú6ë7;8M8·9q:ú:ÿ:Ò<å< 4000"0a0g0ë0Ë1Ù122'24406U8h8Ÿ8²8É:Œ<z>0œÜ4â4è4î4ô4ú455 5555$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5„5Š55–5œ5¢5¨5®5´5º5À5Æ5Ì5Ò5Ø5Þ5ä5ê5ð5ö5ü566666 6&6,62686>6D6J6P6V6\6b6h6n6t6z6€6†6Œ6’6
base_address: 0x00406000
process_identifier: 2240
process_handle: 0x00000470
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2240
process_handle: 0x00000470
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4198400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000046c
process_identifier: 2240
1 0 0

NtResumeThread

 thread_handle: 0x0000046c
suspend_count: 1
process_identifier: 2240
1 0 0