CreateProcessInternalW
|
thread_identifier:
2788
thread_handle:
0x000001c8
process_identifier:
2784
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\ioicjsainqzpfhsxuovfordyvtjwlqcznr"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c8
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2784
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x0000034c
process_identifier:
2784
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c8
process_identifier:
2784
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c8
suspend_count:
1
process_identifier:
2784
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2852
thread_handle:
0x000001c8
process_identifier:
2848
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\sjvvckl"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c8
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2848
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000350
process_identifier:
2848
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
401408
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4583992
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c8
process_identifier:
2848
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c8
suspend_count:
1
process_identifier:
2848
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2916
thread_handle:
0x000001c8
process_identifier:
2912
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\dlbocdvdpg"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000002e8
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x000001c8
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2912
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000354
process_identifier:
2912
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x000002e8
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x000001c8
process_identifier:
2912
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000001c8
suspend_count:
1
process_identifier:
2912
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
3052
thread_handle:
0x00000338
process_identifier:
3048
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\xawfhkqpcdosechtwnitrkvgyroaga"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000358
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000338
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
3048
process_handle:
0x00000358
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x000001c8
process_identifier:
3048
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
491520
process_handle:
0x00000358
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4678260
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000338
process_identifier:
3048
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000338
suspend_count:
1
process_identifier:
3048
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
908
thread_handle:
0x00000338
process_identifier:
1964
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\zucqzcajqlgfoivxfydncxqpyyybzkcid"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000358
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000338
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
1964
process_handle:
0x00000358
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000360
process_identifier:
1964
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
401408
process_handle:
0x00000358
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4583992
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000338
process_identifier:
1964
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000338
suspend_count:
1
process_identifier:
1964
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
1484
thread_handle:
0x00000338
process_identifier:
2100
current_directory:
filepath:
track:
1
command_line:
C:\Users\test22\AppData\Local\Temp\HRD.txt.exe /stext "C:\Users\test22\AppData\Local\Temp\kwhia"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000358
|
1
|
1 |
0
|
NtGetContextThread
|
thread_handle:
0x00000338
|
1
|
0 |
0
|
NtUnmapViewOfSection
|
base_address:
0x00400000
region_size:
4096
process_identifier:
2100
process_handle:
0x00000358
|
1
|
0 |
0
|
NtMapViewOfSection
|
section_handle:
0x00000364
process_identifier:
2100
commit_size:
0
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
base_address:
0x00400000
allocation_type:
0
()
section_offset:
0
view_size:
147456
process_handle:
0x00000358
|
1
|
0 |
0
|
NtSetContextThread
|
registers.eip:
1995571652
registers.esp:
1638384
registers.edi:
0
registers.eax:
4334086
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000338
process_identifier:
2100
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000338
suspend_count:
1
process_identifier:
2100
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
2784
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
2848
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000108
suspend_count:
1
process_identifier:
3048
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x000000fc
suspend_count:
1
process_identifier:
1964
|
1
|
0 |
0
|