What is monday.exe?
monday.exe is part of Hidden Start and developed by NTWind Software according to the monday.exe version information.
monday.exe's description is "Hidden Start (64-bit)"
monday.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected monday.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on monday.exe:
| Property | Value |
|---|---|
| Product name | Hidden Start |
| Company name | NTWind Software |
| File description | Hidden Start (64-bit) |
| Internal name | hstart64.exe |
| Original filename | hstart64.exe |
| Legal copyright | © 2019 NTWind Software |
| Product version | 4.6.0.0 |
| File version | 4.6.0.0 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | Hidden Start |
| Company name | NTWind Software |
| File description | Hidden Start (64-bit) |
| Internal name | hstart64.exe |
| Original filename | hstart64.exe |
| Legal copyright | © 2019 NTWind Software |
| Product version | 4.6.0.0 |
| File version | 4.6.0.0 |
Digital signatures [?]
monday.exe is not signed.
VirusTotal report
37 of the 67 anti-virus programs at VirusTotal detected the monday.exe file. That's a 55% detection rate.
| Scanner | Detection Name |
|---|---|
| Ad-Aware | Trojan.GenericKD.31751032 |
| AegisLab | Trojan.Win32.Noon.4!c |
| Arcabit | Trojan.Generic.D1E47B78 |
| Avast | Win32:Trojan-gen |
| AVG | FileRepMalware |
| Avira | TR/Injector.tvolt |
| BitDefender | Trojan.GenericKD.31751032 |
| CrowdStrike | win/malicious_confidence_60% (W) |
| Cybereason | malicious.5b8873 |
| Cyren | W32/Injector.KXWR-0529 |
| DrWeb | Trojan.Fbng.8 |
| Emsisoft | Trojan.GenericKD.31751032 (B) |
| Endgame | malicious (moderate confidence) |
| ESET-NOD32 | a variant of Win32/Injector.EDZM |
| F-Prot | W32/Injector.HPV |
| Fortinet | W32/Noon!tr |
| GData | Trojan.GenericKD.31751032 |
| Invincea | heuristic |
| K7GW | Trojan ( 005491d81 ) |
| Kaspersky | HEUR:Trojan-Spy.Win32.Noon.gen |
| MAX | malware (ai score=100) |
| McAfee | Artemis!6DE123B0B870 |
| McAfee-GW-Edition | GenericRXGI-CF!F68D21E49E4C |
| Microsoft | PWS:Win32/Mocrt.A!MTB |
| MicroWorld-eScan | Trojan.GenericKD.31751032 |
| NANO-Antivirus | Trojan.Win32.Noon.fnqvzd |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Qihoo-360 | Win32/Trojan.Spy.9dd |
| Rising | Spyware.Noon!8.E7C9 (CLOUD) |
| Sophos | Mal/Generic-S |
| Symantec | Trojan.Gen.2 |
| Trapmine | malicious.high.ml.score |
| TrendMicro-HouseCall | TROJ_GEN.R020H06C419 |
| VBA32 | Malware-Cryptor.Limpopo |
| ViRobot | Trojan.Win32.Z.Noon.656384 |
| ZoneAlarm | HEUR:Trojan-Spy.Win32.Noon.gen |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"regkey_deleted": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mozilla"
],
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\Firefox.png",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft Vision\\",
"C:\\Program Files\\Microsoft DN1"
],
"dll_loaded": [
"ntdll",
"gdi32.dll",
"kernel32.dll",
"UxTheme.dll",
"oleaut32.dll",
"dwmapi.dll",
"ntdll.dll",
"USER32.DLL",
"KERNEL32.DLL",
"advapi32.dll",
"comctl32",
"ole32.dll",
"IMM32.dll",
"version.dll",
"WINTRUST.dll",
"ADVAPI32.dll",
"uxtheme.dll",
"OLEAUT32.dll",
"User32.dll",
"comctl32.dll",
"avicap32.dll",
"shfolder.dll",
"msdmo.dll",
"shell32.dll",
"rpcrt4.dll",
"user32.dll"
],
"file_opened": [
"C:\\Windows\\Branding\\Basebrd\\basebrd.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WOCBNUQ6RX",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\\Instance",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\DirectShow\\MediaObjects",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
"HKEY_LOCAL_MACHINE\\Software\\Borland\\Locales",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
"HKEY_LOCAL_MACHINE\\System\\Setup",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\VFW",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_CURRENT_USER\\Software\\Borland\\Locales",
"HKEY_CLASSES_ROOT\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\DirectShow\\MediaObjects\\Categories\\860bb310-5d01-11d0-bd3b-00a0c911ce86",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin\" ",
"C:\\Windows\\System32\\cmd.exe"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\Firefox.png",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
],
"resolves_host": [
"192.152.0.94"
],
"connects_ip": [
"192.152.0.94"
],
"file_exists": [
"C:\\cuckoo_1788.ini",
"C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll",
"C:\\cuckoo_2648.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\vidccleaner.exe"
],
"file_failed": [
"J:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"O:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"W:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"F:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"T:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"V:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"R:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"C:\\cuckoo_1788.ini",
"L:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"I:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Q:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"D:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Y:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"K:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"M:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Z:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"S:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"B:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"H:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"P:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"E:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"C:\\cuckoo_2648.ini",
"X:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"N:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"G:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin"
],
"guid": [
"{860bb310-5d01-11d0-bd3b-00a0c911ce86}",
"{29840822-5b84-11d0-bd3b-00a0c911ce86}",
"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo8",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Sans Serif",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe",
"C:\\Users\\cuck\\AppData\\Local"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mozilla",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server"
]
}Dropped
[
{
"yara": [],
"sha1": "4500c7348b369ebc7f1f12c1aba945b169f433f7",
"name": "79474e7fcafb2a35_firefox.png",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Mozilla\\Firefox.png",
"type": "data",
"sha256": "79474e7fcafb2a35ab2a13eec4ddb2b0c8c45b960f1881fc6c92186afb8cf1c4",
"urls": [],
"crc32": "D371DE2D",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9916\/files\/79474e7fcafb2a35_firefox.png",
"ssdeep": null,
"size": 656384,
"sha512": "453fd04009f131705ce52efa2958e2f2d82755bcecdf53bc38ca062908d3b2c6564d256199bad966f2cf6b60405761827b67df3314a841530e0ee98b3f6945f7",
"pids": [
2816
],
"md5": "96383364f28afbdd2d3b91093d163864"
},
{
"yara": [],
"sha1": "05e0fcb5b8873f4ed76b098ab1b665faad67aadd",
"name": "6c04db2aca351492_minicalc.exe",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe",
"type": "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed",
"sha256": "6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75",
"urls": [],
"crc32": "B2AD0002",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/9916\/files\/6c04db2aca351492_minicalc.exe",
"ssdeep": null,
"size": 656384,
"sha512": "21b46163481aea2189e3fe696f501f7248ce6c2096e7b5704795130a5fda6a6cd4c68bee3c006e89ab2b173d7c1341f114cc3151dee840499629f2364cf500f0",
"pids": [
2816
],
"md5": "6de123b0b87042ebe4f4e6615e23b8b5"
}
]Generic
[
{
"process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
"process_name": "cmd.exe",
"pid": 2648,
"summary": {
"dll_loaded": [
"ntdll.dll",
"kernel32.dll",
"user32.dll"
],
"file_opened": [
"C:\\Windows\\Branding\\Basebrd\\basebrd.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
],
"file_exists": [
"C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\CompletionChar",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\EnableExtensions",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\PathCompletionChar",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\DisableUNCCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DelayedExpansion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\AutoRun",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\\DefaultColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Command Processor\\CompletionChar"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users"
]
},
"first_seen": 1602104033.34375,
"ppid": 2244
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"process_name": "6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"pid": 2244,
"summary": {
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Microsoft Vision\\",
"C:\\Program Files\\Microsoft DN1"
],
"dll_loaded": [
"USER32.DLL",
"WINTRUST.dll",
"avicap32.dll",
"kernel32.dll",
"OLEAUT32.dll",
"msdmo.dll",
"ADVAPI32.dll",
"rpcrt4.dll",
"ole32.dll",
"User32.dll",
"comctl32.dll"
],
"file_opened": [
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WOCBNUQ6RX",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\\Instance",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\DirectShow\\MediaObjects",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\System\\Setup",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\VFW",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_CLASSES_ROOT\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\DirectShow\\MediaObjects\\Categories\\860bb310-5d01-11d0-bd3b-00a0c911ce86",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
],
"resolves_host": [
"192.152.0.94"
],
"connects_ip": [
"192.152.0.94"
],
"guid": [
"{860bb310-5d01-11d0-bd3b-00a0c911ce86}",
"{29840822-5b84-11d0-bd3b-00a0c911ce86}",
"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"
],
"command_line": [
"C:\\Windows\\System32\\cmd.exe"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\\msvideo8",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server"
]
},
"first_seen": 1602104030.15625,
"ppid": 2816
},
{
"process_path": "C:\\Windows\\explorer.exe",
"process_name": "explorer.exe",
"pid": 1788,
"summary": {
"file_opened": [
"C:\\"
],
"file_exists": [
"C:\\cuckoo_1788.ini",
"C:\\cuckoo_2648.ini"
],
"file_failed": [
"C:\\cuckoo_1788.ini",
"C:\\cuckoo_2648.ini"
]
},
"first_seen": 1602104031.6875,
"ppid": 1740
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1602103985.328125,
"ppid": 376
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"process_name": "6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"pid": 2816,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\Firefox.png",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla"
],
"dll_loaded": [
"UxTheme.dll",
"dwmapi.dll",
"uxtheme.dll",
"version.dll",
"ntdll",
"kernel32.dll",
"gdi32.dll",
"shell32.dll",
"KERNEL32.DLL",
"shfolder.dll",
"oleaut32.dll",
"advapi32.dll",
"comctl32",
"ole32.dll",
"IMM32.dll",
"user32.dll",
"comctl32.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin\" "
],
"regkey_opened": [
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
"HKEY_LOCAL_MACHINE\\Software\\Borland\\Locales",
"HKEY_CURRENT_USER\\Software\\Borland\\Locales"
],
"regkey_deleted": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mozilla"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\vidccleaner.exe"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\Firefox.png",
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
],
"file_failed": [
"J:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"O:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"W:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"F:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"T:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"V:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"R:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"L:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"I:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Q:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"D:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Y:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"K:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"M:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"Z:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"S:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"B:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"H:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"P:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"E:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"X:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"N:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"G:\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Sans Serif",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mozilla"
]
},
"first_seen": 1602103985.78125,
"ppid": 2016
}
]Signatures
[
{
"markcount": 3,
"families": [],
"description": "Command line console output was observed",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Microsoft Windows [Version 6.1.7601]",
"console_handle": "0x00000007"
},
"time": 1602104033.40675,
"tid": 2508,
"flags": {}
},
"pid": 2648,
"type": "call",
"cid": 84
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "Copyright (c) 2009 Microsoft Corporation. All rights reserved.",
"console_handle": "0x00000007"
},
"time": 1602104033.40675,
"tid": 2508,
"flags": {}
},
"pid": 2648,
"type": "call",
"cid": 88
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "WriteConsoleW",
"return_value": 1,
"arguments": {
"buffer": "C:\\Users\\cuck\\AppData\\Local\\Temp>",
"console_handle": "0x00000007"
},
"time": 1602104033.40675,
"tid": 2508,
"flags": {}
},
"pid": 2648,
"type": "call",
"cid": 100
}
],
"references": [],
"name": "console_output"
},
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1602104030.71825,
"tid": 2468,
"flags": {}
},
"pid": 2244,
"type": "call",
"cid": 29
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 1,
"families": [],
"description": "The executable uses a known packer",
"severity": 1,
"marks": [
{
"category": "packer",
"ioc": "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "peid_packer"
},
{
"markcount": 0,
"families": [],
"description": "One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.",
"severity": 2,
"marks": [],
"references": [],
"name": "dumped_buffer"
},
{
"markcount": 8195,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x003f0000"
},
"time": 1602103985.93725,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 2816,
"type": "call",
"cid": 563
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10410000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15608
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10420000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15612
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10430000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15616
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10440000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15620
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10450000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15624
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10460000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15628
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10470000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15632
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10480000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15636
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10490000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15640
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15644
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15648
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15652
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104d0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15656
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104e0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15660
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x104f0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15664
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10500000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15668
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10510000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15672
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10520000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15676
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10530000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15680
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10540000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15684
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10550000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15688
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10560000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15692
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10570000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15696
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10580000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15700
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10590000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15704
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15708
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15712
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15716
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105d0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15720
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15724
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x105f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15728
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10600000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15732
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10610000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15736
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10620000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15740
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10630000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15744
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10640000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15748
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10650000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15752
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10660000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15756
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10670000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15760
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10680000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15764
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10690000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15768
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106a0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15772
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106b0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15776
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106c0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15780
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106d0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15784
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15788
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x106f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15792
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10700000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15796
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x10710000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15800
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 0,
"families": [],
"description": "Checks whether any human activity is being performed by constantly checking whether the foreground window changed",
"severity": 2,
"marks": [],
"references": [
"https:\/\/www.virusbtn.com\/virusbulletin\/archive\/2015\/09\/vb201509-custom-packer.dkb"
],
"name": "antisandbox_foregroundwindows"
},
{
"markcount": 14,
"families": [],
"description": "Foreign language identified in PE resource",
"severity": 2,
"marks": [
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_BITMAP",
"language": "LANG_ARABIC",
"offset": "0x00090d14",
"filetype": "empty",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000000e8"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_UKRAINIAN",
"offset": "0x00147d50",
"filetype": "MS Windows icon resource - 1 icon, 32x32",
"sublanguage": "SUBLANG_DEFAULT",
"type": "generic",
"size": "0x00000014"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_UKRAINIAN",
"offset": "0x00147d50",
"filetype": "MS Windows icon resource - 1 icon, 32x32",
"sublanguage": "SUBLANG_DEFAULT",
"type": "generic",
"size": "0x00000014"
},
{
"name": "RT_MANIFEST",
"language": "LANG_ARABIC",
"offset": "0x00148338",
"filetype": "XML 1.0 document, ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_ARABIC_EGYPT",
"type": "generic",
"size": "0x000002f0"
}
],
"references": [],
"name": "origin_langid"
},
{
"markcount": 1,
"families": [],
"description": "Creates a suspicious process",
"severity": 2,
"marks": [
{
"category": "cmdline",
"ioc": "C:\\Windows\\System32\\cmd.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "suspicious_process"
},
{
"markcount": 1,
"families": [],
"description": "Drops an executable to the user AppData folder",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "exe_appdata"
},
{
"markcount": 1,
"families": [],
"description": "A process created a hidden window",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 2508,
"thread_handle": "0x000001cc",
"process_identifier": 2648,
"current_directory": "",
"filepath": "C:\\Windows\\System32\\cmd.exe",
"track": 1,
"command_line": "",
"filepath_r": "C:\\Windows\\System32\\cmd.exe",
"stack_pivoted": 0,
"creation_flags": 134217728,
"process_handle": "0x000001c4",
"inherit_handles": 0
},
"time": 1602104033.00025,
"tid": 2468,
"flags": {
"creation_flags": "CREATE_NO_WINDOW"
}
},
"pid": 2244,
"type": "call",
"cid": 765
}
],
"references": [],
"name": "stealth_window"
},
{
"markcount": 1,
"families": [],
"description": "Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2816,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 1,
"length": 81920,
"protection": 32,
"process_handle": "0xffffffff",
"base_address": "0x020e1000"
},
"time": 1602104033.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READ"
}
},
"pid": 2816,
"type": "call",
"cid": 50250
}
],
"references": [],
"name": "protection_rx"
},
{
"markcount": 2,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.868417362197521,
"section": {
"size_of_data": "0x00075600",
"virtual_address": "0x000a8000",
"entropy": 7.868417362197521,
"name": "UPX1",
"virtual_size": "0x00076000"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.73359375,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 2,
"families": [],
"description": "The executable is compressed using UPX",
"severity": 2,
"marks": [
{
"section": "UPX0",
"type": "generic",
"description": "Section name indicates UPX"
},
{
"section": "UPX1",
"type": "generic",
"description": "Section name indicates UPX"
}
],
"references": [],
"name": "packer_upx"
},
{
"markcount": 8695,
"families": [],
"description": "Allocates execute permission to another process indicative of possible code injection",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2244,
"region_size": 118784,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000104",
"allocation_type": 12288,
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 11964
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10410000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15611
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10420000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15615
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10430000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15619
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10440000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15623
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10450000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15627
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10460000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15631
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10470000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15635
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10480000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15639
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10490000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15643
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15647
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15651
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15655
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104d0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15659
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104e0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15663
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104f0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15667
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10500000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15671
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10510000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15675
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10520000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15679
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10530000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15683
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10540000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15687
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10550000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15691
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10560000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15695
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10570000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15699
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10580000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15703
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10590000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15707
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15711
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15715
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15719
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105d0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15723
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15727
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15731
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10600000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15735
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10610000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15739
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10620000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15743
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10630000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15747
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10640000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15751
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10650000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15755
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10660000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15759
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10670000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15763
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10680000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15767
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10690000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15771
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106a0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15775
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106b0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15779
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106c0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15783
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106d0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15787
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15791
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15795
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10700000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15799
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10710000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15803
}
],
"references": [],
"name": "allocates_execute_remote_process"
},
{
"markcount": 1,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mozilla",
"reg_value": "C:\\Users\\cuck\\AppData\\Local\\Mozilla\\MiniCalc.exe"
}
],
"references": [],
"name": "persistence_autorun"
},
{
"markcount": 129,
"families": [],
"description": "Creates a thread using CreateRemoteThread in a non-child process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2816 created a remote thread in non-child process 0",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48399
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48414
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48429
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48444
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48459
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48474
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48489
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48504
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48519
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48534
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48549
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48564
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48579
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48594
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48609
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48624
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48639
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.12525,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48654
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48669
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48684
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48699
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48714
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48729
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48744
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48759
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48774
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48789
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48804
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48819
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48834
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48849
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48864
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48879
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48894
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48909
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48924
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48939
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48954
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.14025,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48969
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48984
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 48999
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49014
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34566892,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49029
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49040
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34567642,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49055
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34567642,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49070
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34567642,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49085
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 34567642,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49100
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "CreateRemoteThread",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"process_identifier": 0,
"function_address": "0x00000000",
"flags": 0,
"process_handle": "0x00000000",
"parameter": "0x00000000",
"stack_size": 0
},
"time": 1602104033.15625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 49111
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_createremotethread"
},
{
"markcount": 8693,
"families": [],
"description": "Manipulates memory of a non-child process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2816 manipulating memory of non-child process 0",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10410000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15611
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10420000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15615
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10430000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15619
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10440000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15623
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10450000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15627
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10460000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15631
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10470000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15635
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10480000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15639
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10490000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15643
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15647
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15651
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15655
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104d0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15659
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104e0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15663
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104f0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15667
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10500000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15671
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10510000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15675
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10520000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15679
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10530000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15683
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10540000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15687
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10550000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15691
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10560000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15695
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10570000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15699
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10580000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15703
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10590000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15707
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15711
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15715
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15719
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105d0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15723
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15727
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x105f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15731
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10600000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15735
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10610000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15739
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10620000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15743
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10630000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15747
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10640000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15751
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10650000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15755
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10660000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15759
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10670000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15763
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10680000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15767
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10690000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15771
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106a0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15775
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106b0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15779
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106c0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15783
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106d0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15787
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106e0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15791
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x106f0000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15795
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10700000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15799
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10710000"
},
"time": 1602104030.21825,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15803
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_modifies_memory"
},
{
"markcount": 6,
"families": [],
"description": "Potential code injection by writing to the memory of another process",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0006\u0000>hs\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u0002\u0001\u000b\u0001\u000e\u0010\u0000\u0004\u0001\u0000\u0000\u0096\u0000\u0000\u0000\u0000\u0000\u00008W\u0000\u0000\u0000\u0010\u0000\u0000\u0000 \u0001\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00d0\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000@\u0085\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\\I\u0001\u0000\u0018\u0001\u0000\u0000\u0000\u0080\u0001\u0000p,\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00b0\u0001\u0000d\r\u0000\u0000\u00e0G\u0001\u0000\u001c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0001\u0000@\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u0014\u0003\u0001\u0000\u0000\u0010\u0000\u0000\u0000\u0004\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.rdata\u0000\u0000\u00f2:\u0000\u0000\u0000 \u0001\u0000\u0000<\u0000\u0000\u0000\b\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.data\u0000\u0000\u0000@\u001d\u0000\u0000\u0000`\u0001\u0000\u0000\u0006\u0000\u0000\u0000D\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000p,\u0000\u0000\u0000\u0080\u0001\u0000\u0000.\u0000\u0000\u0000J\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.reloc\u0000\u0000d\r\u0000\u0000\u0000\u00b0\u0001\u0000\u0000\u000e\u0000\u0000\u0000x\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000B.bss\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u00c0\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0086\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11965
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "\u0000\u0000\u0000\u0000m\u0011@\u0000\u008f\u0011@\u0000\u009e\u0011@\u0000\u00ad\u0011@\u0000\u00bc\u0011@\u0000\u00cb\u0011@\u0000\u00da\u0011@\u0000\u00fc\u0011@\u0000\u000b\u0012@\u0000 \u0012@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0001\u0001\u0001\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0099T\u00cd<\u00a8\u0087\u0010K\u00a2\u0015`\u0088\u0088\u00dd;UB\u00c4\u00f4K\u008a\u009b\u00a0A\u00b3\u0080\u00ddJpM\u00db(H\u00bb\u00ef\u00be\u00ad\u00de\u00ef\u00be\u00ad\u00deH\u00b8\u00ef\u00be\u00ad\u00de\u00ef\u00be\u00ad\u00de\u00ff\u00e3\u0000\u0000\u00b8\u00ef\u00be\u00ad\u00de\u00e9\u00ef\u00be\u00ad\u00de\u0000\u0000\u0000\u0000\u0000\u0000U\u008b\u00ec\u008bU\u0010\u008bE\b\u008b\u00c8\u0085\u00d2t\t\u00c6\u0001\u0000A\u0083\u00ea\u0001u\u00f7]\u00c3U\u008b\u00ecd\u00a10\u0000\u0000\u0000\u0083\u00ec\u0018\u008b@\fSVW\u008bx\f\u00e9\u00a7\u0000\u0000\u0000\u008bG03\u00f6\u008b_,\u008b?\u0089E\u00f8\u008bB<\u0089}\u00f4\u008bD\u0010x\u0089E\u00f0\u0085\u00c0\u000f\u0084\u0085\u0000\u0000\u0000\u00c1\u00eb\u00103\u00c9\u0085\u00dbt-\u008b}\u00f8\u000f\u00be\u0014\u000f\u00c1\u00ce\r\u0080<\u000fa\u0089U\u00f8|\t\u008b\u00c2\u0083\u00c0\u00e0\u0003\u00f0\u00eb\u0003\u0003u\u00f8A;\u00cbr\u00df\u008bU\u00fc\u008b}\u00f4\u008bE\u00f0\u008bL\u0010\u00183\u00db\u008bD\u0010 \u0003\u00c2\u0089M\u00ec\u0085\u00c9t<\u008b\b3\u00ff\u0003\u00ca\u0083\u00c0\u0004\u0089M\u00f8\u008b\u00d1\u0089E\u00e8\u008a\n\u00c1\u00cf\r\u000f\u00be\u00c1\u0003\u00f8B\u0084\u00c9u\u00f1\u008bU\u00fc\u0089}\u00f8\u008bE\u00f8\u008b}\u00f4\u0003\u00c6;E\bt \u008bE\u00e8C;]\u00ecr\u00c4\u008bW\u0018\u0089U\u00fc\u0085\u00d2\u000f\u0085K\u00ff\u00ff\u00ff3\u00c0_^[\u00c9\u00c2\u0004\u0000\u008bu\u00f0\u008bD\u0016$\u008d\u0004X\u000f\u00b7\f\u0010\u008bD\u0016\u001c\u008d\u0004\u0088\u008b\u0004\u0010\u0003\u00c2\u00eb\u00ddU\u008b\u00ec\u0081\u00ec\u00bc\u0000\u0000\u0000\u008bE\bSVW\u008b\b\u008dX\u0004hLw&\u0007\u0089M\u00a0\u0089]\u00b8\u00e8\u00e8\u00fe\u00ff\u00ff\u008b\u00f0\u00c7E\u00c4kern3\u00c0\u00c7E\u00c8el32\u0088E\u00d0\u0088E\u00de\u008dE\u00c4P\u00c7E\u00cc.dll\u00c7E\u00e0ntdl\u00c7E\u00e4l.dlf\u00c7E\u00e8l\u0000\u00c7E\u00d4user\u00c7E\u00d832.df\u00c7E\u00dcllf\u00c7E\u00f81\u0000f\u00c7E\u00fc2\u0000\u00ff\u00d6\u008dE\u00e0P\u00ff\u00d6\u008dE\u00d4P\u00ff\u00d6hX\u00a4S\u00e5\u00e8y\u00fe\u00ff\u00ffhy\u00cc?\u0086\u0089E\b\u00e8l\u00fe\u00ff\u00ffhE\u0083V\u0007\u0089E\u00f4\u00e8_\u00fe\u00ff\u00ffhD\u00f05\u00e0\u0089E\u00c0\u00e8R\u00fe\u00ff\u00ffh\u00ee\u0095\u00b6P\u0089E\u00a4\u00e8E\u00fe\u00ff\u00ffh\u00c6\u0096\u0087R\u0089E\u009c\u00e88\u00fe\u00ff\u00ffh_xT\u00ee\u0089E\u00f0\u00e8+\u00fe\u00ff\u00ffh\u00da\u00f6\u00daO\u0089E\u0098\u00e8\u001e\u00fe\u00ff\u00ff\u008b\u00f8h\u00c6\u0012\u001ep\u0089}\u00b4\u00e8\u000f\u00fe\u00ff\u00ffh\u00ad\u009e_\u00bb\u008b\u00f0\u00e8\u0003\u00fe\u00ff\u00ffh-W\u00ae[\u0089E\u00bc\u00e8\u00f6\u00fd\u00ff\u00ff\u0089E\u00ac3\u00c0Ph\u0080\u0000\u0000\u0000j\u0003PPh\u0000\u0000\u0000\u0080S\u0089E\u00a8\u00ff\u00d7j\u0000\u0089E\u00ecP\u00ff\u00d6\u008b]\b\u008b\u00f8\u0089}\u00b0j\u0004h\u00000\u0000\u0000Wj\u0000\u00ff\u00d3\u008b\u00f0\u0085\u00f6t\u00eej\u0000\u008dE\u00a8PW\u008b}\u00ecVW\u00ffU\u00bcW\u00ffU\u00f0\u0080>M\u008b]\u00b8t\fj\u0000\u008dE\u00f8PPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0000h\u00e0.\u0000\u0000\u00ffU\u00a43\u00c0\u008d}\u0088\u00abjDj\u0000\u00ab\u00ab\u00ab\u008d\u0085D\u00ff\u00ff\u00ffP\u00e8T\u00fd\u00ff\u00ff\u0083\u00c4\f\u00ffu\u00a0j\u0000h\u00ff\u00ff\u001f\u0000\u00ffU\u009c\u0089E\u00bc\u0085\u00c0uO\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0\u000f\u0085\u00af\u0000\u0000\u0000PPj\u0002PPh\u0000\u0000\u0000@S\u0089E\u00b8\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft\u0005\u008dE\u00b8\u00eb^\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00e9\u0084\u0000\u0000\u0000\u0083e\u00ec\u0000\u008dM\u00ecQP\u00ffU\u0098\u0081}\u00ec\u0003\u0001\u0000\u0000to\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0uOPPj\u0002PPh\u0000\u0000\u0000@S\u0089E\b\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft*\u008dE\bP\u00ffu\u00b0VW\u00ffU\u00acW\u00ffU\u00f0\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u00eb\n\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0001\u00ffu\u00bc\u00ffU\u00f0\u0080}\u000b\u0000\u000f\u0084\u00e5\u00fe\u00ff\u00ff_^[\u00c9\u00c3\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00c4;A\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x00416000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11968
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "\u0000\u0010\u0000\u0000\u0084\u0000\u0000\u0000\u008a0\u00900\u00a00\u00b50\u00bc0\u00c90\u00d00o1u1|1\u00831\u008a1\u00951\u00a41\u00b31\u00c21\u00d11\u00dc1\u00e21\u00e91\u00f01\u00f71\u00022\r2\u00172\"2(2\/262=2D2N2n2\u00f7:\u0002;\r;&;1;<;G;R;];h;\u0087;\u0098;\u00a3;\u00ae;\u00b9;\u00c4;\u00cf;\u00e8;\u00f1;\u0018\u00c7>\u00cf>\u0000\u0000\u0000 \u0000\u0000d\u0000\u0000\u0000\u00ea0\u00d01_4j4\u009f4\u00b54\u00c04\u00dc4\u00e94\u00f94%5,5\u00a35\u00c95\u00dc5\u00fb5m6\u00da6\u00fd6\u00047\u001d7u7\u00f07\u000e8\u00958\u00af8\u00d18\u00f58\u00fb8?9\u00809\u00cb9 ;P;\u00c3;\u00c8;\u00d5;\u00e3;\u00f5;[>\u0092>\u00bd>\u0019?0?~?\u00cf?\u00000\u0000\u0000\u00c0\u0000\u0000\u0000\u001a000N0U0-1A1V1u1\u00901\u009d1\u00b01\u00e21$2\u009b2\u00ef2I3t3\u00b63\u00cd3\u00e83\u001f4\u008b5\u00ce5\r6!616|6\u008c6\u00966\u009d6\u00a66\u00be6\u00f66\u00067'7A7K7W7^7j7q7}7\u00847\u00907\u00977\u00dc7\u00ee7\t8\u00108]8k8|8\u00d48\u00e68\u00ed8\u00f98\u00009\u001a9!91989D9K9W9^9\u00e39\u00fe9S:Z:a:j:\u00e8:\u00ef:\u00fd:\u0006;J;Q;X;a;\u00b2;\u00d8;\/\u00bf>\u00e5>\u00bd?\u00ea?\u0000@\u0000\u0000x\u0000\u0000\u0000\u00ab0\u00d80\u00b41\u00fa1+3X3\u00883\u008e3\u00d43\u00db3\u00cf4\u00045e5\u00cf5K6]6\u00bc6\u00eb6\u0014737<7\u00af8\u00e19\u0004:S;p;\u0091;\u00b2;\u00cc;\u00e9;\u00063>P>m>\u00d7>\u00ed>\u0006?\u001c?\u0013?\u00a5?\u0000\u0000\u0000p\u0000\u0000l\u0001\u0000\u0000\u00880\u00da0\u00b71\u00bf1\u00dd1\u00863\u008c3\u00b03\u00c43\u00d63\u00db3\u00e13\u00e93\u00f63\u001f4&454A4R4k4q4{4\u00824\u008a4\u00904\u009c4\u00a64\u00135+505:5D5N5X5b5l5v5\u00805\u008a5\u00985\u009f5\u00c35\u00e15\u00e85>6H6R6t6~6\u00886\u00b16\u00bb6\u00c56\u00cf6\u00d96\u00f66\u00007\n7\u00147d7n7x7\u00827\u00ab7\u00b07\u00b57\u00c87\u00cd7\u00d27\u00d97\u00e67\u00eb7\u00f07$8)8.888=8B8O8T8Y8f8k8p8}8\u00828\u00878\u00b88\u00c58\u00ca8\u00cf8\u00dc8\u00e18\u00e68\u00f38\u00f88\u00029\u00149!9%9)9-9195999=9A9E9_9\u00919\u00a49\u00bc9\u00d59\u00ee9\u00fb9\u0001:\u0010:8:Z:_:{:\u0081:\u008d:\u009c:\u00a6:\u00b1:\u00ca:\u00d5:\u00da:\u00e9:\u00f5:\t;\u0014;\u001d;\u0086;\u00a3;\u00d9;\u00f6;\u0007<3<[\u0012>\u0018>$><>M>W>`>\u0083>\u00b2>\u00f4>\u0085?\u009f?\u0000\u0080\u0000\u0000@\u0001\u0000\u0000$0:0\u00bd0\u00e40\u00f70\u000e1 1%1+131;1F1K1o1\u00841\u00891\u00b21\u000b2,2G2w2~2\u00842\u00a72\u00c02\u00c62\u00d02\u00e52\u00ef2\n3\u001f3=3H3u3\u00813\u00883\u00943\u00a03\u00aa3\u00b03\u00b63\u00c63\u00ce3\u00d43\u00da3\u00e53\u00ed3\u00f43\u00fa3\u00024\r4\u00134\u00184\u001d4)4?4J4V4[4b4l4r4{4\u00814\u00864\u008e4\u00994\u00aa4\u00af4\u00b54\u00c54\u00d64\u00db4\u00e14\u00e64\u00ec4\u00f64\u00fc4\u00015\u000f5\u00145\u001b5!5'5.5;5@5L5Q5^5c5\u00be5%62696F6v6}6K8\u00cd8\u00d88\u00ec8\u00f68\u00ff8\n929:9@9K9i9\u00939\u00a19\u00c79\u00f09,:P:\u00a1:\u00a6:\u00ab:\u00b2:\u0013;\";2;B;R;b;r;\u0082;\u0092;\u00a2;\u00b2;\u00c2;15>|>\u00c0>\u0004?H?\u008c?\u00f9?\u0000\u0090\u0000\u0000t\u0000\u0000\u0000f0\u00d30p1\u00a61\u00d61\u00dd1\u00f81>2g2\u00a22\u00bb2\u00c82\u00ff2\u00973\u00af3\u00d83\u00f23Y4\u00a94\u00e94 5_6\u00dd6\u00e4647w7\u00917\u009e7\u00af7\u00d37\u00ec7\u00f97;8\u00d38\u00eb8\u00149.9\u00959\u00e59%:b:\u00ad;+<2<\u008f<\u00bd<\n=I=\u0095=\u00c7=\u00fa=\u00e2>\u0015?\u0000\u0000\u0000\u00a0\u0000\u0000\u00c8\u0000\u0000\u0000\u001a0f0m0u0\u008a0\u009c0\u00b20\u00c80\u00f30=1\u00c01\u00c91\u00ce1\u00e71\u00002\u0019222K2d2}2\u009c2\u00b72\u00fa2\u00133L3\u00b43\u00c43\u00d73\u00ea3\u00fd3\u00104#464I4e4\u00b94?5\u00ed5\u00f95\t6\u00196)696I6Y6d6w6\u00826\u00986\u00b46\u00d06\u00ec6\b7X8\u00f38\u00f88\u00119*9C9\\9u9\u008e9\u00a79\u00c09\u00e19\u00fa9;:V:\u0091:\u0019;);<;O;b;u;\u0088;\u009b;\u00ae;\u00ca;\u0019< <. >1>C>\u00ad?\u00c8?\u0000\u0000\u0000\u00b0\u0000\u0000\u00f8\u0000\u0000\u0000\u00011\f1\u00111\u001c1-12171A1U1Z1_1m1u1|1\u00821\u00911\u009b1\u00a01\u00a71\u00b81\u00c01\u00c71\u00ce1\u00d51\u00dc1\u00e31D2\u00b12\u00d52$3|3\u008a3\u009b3\u00c53\u00144\/454:4E4J4U4Z4d4z4\u00aa4\u00be4\u00f74\u00015\u00165\/595F5M5S5X5\u00a15\u00c25\u00e95\u00f25\u00076\u00146-6;6U6^6s6\u00806\u008d6\u00976\u00a96\u00b26\u00c06\u00dd6\u00e76\u00007\r7\u001c7&7G7R7e7\u00927\u009f7\u00ac7\u00b97\u00c67\u00d37\u001d8\u00978\u00ec8\u009a9\u00ac9\u00c29\b;1;I;\u00b0;\u00c9;\u0000<)<3\u0014>:>K>\u0090>\u0095>\u00a3>\u00c9>\u00d6>r?\u0098?\u00a5?\u00f1?\u0000\u00c0\u0000\u0000D\u0001\u0000\u000060T0\u00f40\u00c91\u00da142\u00832\u00e72'3Q3]3e3o3u3\u009e3\u00a43\u00aa3\u00b03\u00bb3\u00c13\u00cc3\u00d23\u00dd3\u00e33\u00ee3\u00f43\u00ff3\u00054\u00104\u00164 4&42474=4Q4\\4h4m4t4\u00804\u00864\u008a4\u00904\u00a24\u00bc4\u00db4\u00f44\u00145-5v5\u00c25\u00c75\u00f95\u00166>6I6[6d6m6s6\u00826\u00a16\u00a86\u00b46\u00b96\u00da6\u00f76\u00fc6\u00027\u000e7\u00187\u001d7>7S7Y7e7m7w7}7\u00847\u008a7\u00ab7\u00b07\u00b57\u00bb7\u00c17\u00cb7\u00d07\u00e77\u00fd7&8;8W8d8p8\u00878\u00e28\u00ef8\"9R9\u00ca9P:^:\u008c:\u00a0:\u00ad:\u00be:\u00fa:8;F;];|;\u008f;\u00ad;\u000f<\u0014<\u001b< <)<\/<4\u0007>\u000e>\u0012>.>4>]>d>r>\u0087>\u008f>\u00ec>0?\u008e?\u0095?\u0000\u00d0\u0000\u0000\u00b8\u0000\u0000\u0000$0\u009d0\u00d10\u00ea0\u00fc0$151C1i1|1\u00b71\u00c71\u00cf1\u0007242D2M2T2\u00832\u00932\u009c2\u00a32 3E3O3]3\u00833\u00aa3\u00f73\b4=4]4q4}4\u00c24\u00d84\u00fa4\u00125O5t5\u00845\u008d5\u0094587?7]7r7\u00867\u00a17\u00cb7\u00fc7\u00078&8@8\u00818\u008a8\u00b68\u00c18\u00ea8\u0013919?9\u00939\u00a59\u00c99<:~: ;\u008a;\u00b1;\u00e1;[<\u0088<\u009e<\u00ad<\u00d2<\u00e2<\u0010=k=s={=\u0086=\u0092=\u009d=\u00b2=\u00ba=\u00ca=\u0000\u0000\u0000\u00e0\u0000\u0000p\u0000\u0000\u0000\u000b2J2\u00013\u00173+3?3\u00bc4\u00b45W6n6\u00836\u008d6\u009a6\u00017+70787?7\u00847\u00997\u00b17\u00bc7\u00cd7\u00e97\u00f97\u00028W8p8{8\u00e58\u001b9J9n9u9\u00d29\u00e49%:H:{:\u00a5:\u00d3:\u00f6:9;\u0081;\u009c;\u0090<\u00b8<\u00e3=\">@>^>\u0000\u0000\u0000\u00f0\u0000\u0000\u00fc\u0000\u0000\u0000@0F0\u00b30\u00c00\u00cd0=1F1T1o1\u00991\u00ad1\u00bb1\u00c21\u00c91\u00012\u000e2+20272D2M2V2l2~2\u00842\u00922\u009b2\u00a52\u00af2\u00b62\u00893\u00a23\u00ce3\u00e73\u00154:4X4`4{4\u00954\u00c94\u00e14\u000b5F5]5d5\u00f75\u00026\u00136\u001a6<6C6g6u6|6\u00836\u00c06\u00cf6\u00037\u000e7,7?7^7h77\u00bf7\u00c67\u00de7\u000b8\u0018828=8\t959t9\u00959}:\u0088:\u0091:\u00a1:\u00a8:\u00ae:\u00b7:\u00c2:\u00cb:\u00ef:\u00fa:\u0000;\u000f;\u0015;\u001f;%;);L;R;W;k;w;;\u0085;\u0098;\u00f6;\u0010o>\u0085>\u008a>\u00a2>\u00d3>\u00db>\u00ef>\u00fe>\u001b?8?\u0000\u0000\u0001\u0000\u00e8\u0000\u0000\u0000\u0019050A0I0U0l0\u00940\u00b10\u00be0\u00d50w1\u009b1\u00a81\u00b01\u00c31\u00e21\u0016414:4C4I4^4\u00944\u009d4\u00a34\u00b44\u00c24\u00dc4\u00f34\u00cd5\u00126\u00cd6\u00e16\"7-777A7K7v7\u00897\u00947\u00aa7\u00d27\u00e47\u00eb7\u00148\u001b8i8y8\u008d8\u00c68\u00cb8\u00d8899M9@:l:\u00ab:\u00ca:\u00d5:\u00e4:\u00ee:\u00fd:\u0007;\u0011;g;l;z;\u0089;+<2\u001b>%>\/>9>\u0087>\u00a2>\u00ac>\u00bb>\u00c1>\u00d0>\u00eb>\u00f5>\u0004?\n?\u0019?4?>?M?S?b?}?\u0087?\u0092?\u0098?\u00a4?\u00bf?\u00c9?\u00d4?\u00da?\u00e4?\u0000\u0010\u0001\u0000X\u0000\u0000\u0000\u00000\n0\u00140\u001e0(060;0@0E0J0\u00ae0\u00cb0\u00e80\u00071&1:1T1[1k1r1\u009c1b2n2u2{2\u00842\u00892\u009c2\u00a12\u00a62\u00ab2\u00b22\u00b92\u00bd2\u00c32\u00e12\u00eb2\u00f62\u00013\u000b3\u0000 \u0001\u0000\u00c0\u0000\u0000\u0000 4$4\u00b44\u00b84\u00bc4\u00c04\u00c44\u00c84\u00cc4\u00d04\u00d44\u00d84\u00dc4\u00e04\u00e44\u00e84\u00ec4\u00f04\u00f44\u00f84\u00fc4\u00005\u00045\b5\f5\u00105\u00145\u00185\u001c5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5\u00805\u00845\u00885\u008c5\u00905\u00945\u00985\u009c5\u00a05\u00a45\u00a85\u00ac5\u00b05\u00b45\u00b85\u00bc5\u00c05\u00c45\u00c85\u00cc5\u00d05\u00d45\u00d85\u00dc5\u00e05\u00e45\u00e85\u00ec5\u00f05\u00f45\u00f85\u00fc5\u00006\u00046\b6\f6\u00106\u00146\u00186\u00000\u0001\u0000\u0014\u0000\u0000\u0000\u00a4;\u00a8;\u00ac;\u00c4;\u00c8;\u00cc;\u0000@\u0001\u00008\u0000\u0000\u0000\u00046\b6`6d6h6l6p6\u00a46\u00a86\u00e46\u00e86\u00fc6\u00007\u00047\b7|7\u00807\u00847\u00887\u008c7\u00907\u00947\u00987\u0000\u0000\u0000`\u0001\u0000 \u0000\u0000\u0000\u00040\b0\f0\u00100\u00140\u00180\u001c0 0$0(0x5\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x0041b000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11970
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "2\u0000\u0000\u0000\u00bd\u009cJ1\u0097\">sknR\u00a0\u0090\u00d6\u00d5\u00fc\u001c\u00a6\u00e2H\u00e0T\u0015I$|\u00c5\u0097\u0085\u009e\u0003\u00c3\u00efwG\u0098\u00d6iA\u00ce\u00ca'\u009faz|i\u00f3\u0085\u00ba(\u0090\u0095\u00f6\u00bf\"'|\u009c\u00bbz2`_Ur\u0007\u00de\u00e5A%\u00ef\u00e8\u00d3\u00c0\u00fbC\u00f4\u0003\u009c3\u0080\u00af\u00ab\u00f3\u0018\u00a0?!\u00ef\u0013\u00fejL\u001b\u00e2b\u00ab\u00b7\u0099\u008a\u0085\u00ebP\u00ca\u00c7@\b\u00f3\u00d6\u00f4nol}\u00b7\u00a7\r\u00b9\u00b2\u0001\u00fb\u00b9\u00fb\u00f7\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x0041c000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11971
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2648,
"buffer": "U\u008b\u00ec\u008bU\u0010\u008bE\b\u008b\u00c8\u0085\u00d2t\t\u00c6\u0001\u0000A\u0083\u00ea\u0001u\u00f7]\u00c3U\u008b\u00ecd\u00a10\u0000\u0000\u0000\u0083\u00ec\u0018\u008b@\fSVW\u008bx\f\u00e9\u00a7\u0000\u0000\u0000\u008bG03\u00f6\u008b_,\u008b?\u0089E\u00f8\u008bB<\u0089}\u00f4\u008bD\u0010x\u0089E\u00f0\u0085\u00c0\u000f\u0084\u0085\u0000\u0000\u0000\u00c1\u00eb\u00103\u00c9\u0085\u00dbt-\u008b}\u00f8\u000f\u00be\u0014\u000f\u00c1\u00ce\r\u0080<\u000fa\u0089U\u00f8|\t\u008b\u00c2\u0083\u00c0\u00e0\u0003\u00f0\u00eb\u0003\u0003u\u00f8A;\u00cbr\u00df\u008bU\u00fc\u008b}\u00f4\u008bE\u00f0\u008bL\u0010\u00183\u00db\u008bD\u0010 \u0003\u00c2\u0089M\u00ec\u0085\u00c9t<\u008b\b3\u00ff\u0003\u00ca\u0083\u00c0\u0004\u0089M\u00f8\u008b\u00d1\u0089E\u00e8\u008a\n\u00c1\u00cf\r\u000f\u00be\u00c1\u0003\u00f8B\u0084\u00c9u\u00f1\u008bU\u00fc\u0089}\u00f8\u008bE\u00f8\u008b}\u00f4\u0003\u00c6;E\bt \u008bE\u00e8C;]\u00ecr\u00c4\u008bW\u0018\u0089U\u00fc\u0085\u00d2\u000f\u0085K\u00ff\u00ff\u00ff3\u00c0_^[\u00c9\u00c2\u0004\u0000\u008bu\u00f0\u008bD\u0016$\u008d\u0004X\u000f\u00b7\f\u0010\u008bD\u0016\u001c\u008d\u0004\u0088\u008b\u0004\u0010\u0003\u00c2\u00eb\u00ddU\u008b\u00ec\u0081\u00ec\u00bc\u0000\u0000\u0000\u008bE\bSVW\u008b\b\u008dX\u0004hLw&\u0007\u0089M\u00a0\u0089]\u00b8\u00e8\u00e8\u00fe\u00ff\u00ff\u008b\u00f0\u00c7E\u00c4kern3\u00c0\u00c7E\u00c8el32\u0088E\u00d0\u0088E\u00de\u008dE\u00c4P\u00c7E\u00cc.dll\u00c7E\u00e0ntdl\u00c7E\u00e4l.dlf\u00c7E\u00e8l\u0000\u00c7E\u00d4user\u00c7E\u00d832.df\u00c7E\u00dcllf\u00c7E\u00f81\u0000f\u00c7E\u00fc2\u0000\u00ff\u00d6\u008dE\u00e0P\u00ff\u00d6\u008dE\u00d4P\u00ff\u00d6hX\u00a4S\u00e5\u00e8y\u00fe\u00ff\u00ffhy\u00cc?\u0086\u0089E\b\u00e8l\u00fe\u00ff\u00ffhE\u0083V\u0007\u0089E\u00f4\u00e8_\u00fe\u00ff\u00ffhD\u00f05\u00e0\u0089E\u00c0\u00e8R\u00fe\u00ff\u00ffh\u00ee\u0095\u00b6P\u0089E\u00a4\u00e8E\u00fe\u00ff\u00ffh\u00c6\u0096\u0087R\u0089E\u009c\u00e88\u00fe\u00ff\u00ffh_xT\u00ee\u0089E\u00f0\u00e8+\u00fe\u00ff\u00ffh\u00da\u00f6\u00daO\u0089E\u0098\u00e8\u001e\u00fe\u00ff\u00ff\u008b\u00f8h\u00c6\u0012\u001ep\u0089}\u00b4\u00e8\u000f\u00fe\u00ff\u00ffh\u00ad\u009e_\u00bb\u008b\u00f0\u00e8\u0003\u00fe\u00ff\u00ffh-W\u00ae[\u0089E\u00bc\u00e8\u00f6\u00fd\u00ff\u00ff\u0089E\u00ac3\u00c0Ph\u0080\u0000\u0000\u0000j\u0003PPh\u0000\u0000\u0000\u0080S\u0089E\u00a8\u00ff\u00d7j\u0000\u0089E\u00ecP\u00ff\u00d6\u008b]\b\u008b\u00f8\u0089}\u00b0j\u0004h\u00000\u0000\u0000Wj\u0000\u00ff\u00d3\u008b\u00f0\u0085\u00f6t\u00eej\u0000\u008dE\u00a8PW\u008b}\u00ecVW\u00ffU\u00bcW\u00ffU\u00f0\u0080>M\u008b]\u00b8t\fj\u0000\u008dE\u00f8PPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0000h\u00e0.\u0000\u0000\u00ffU\u00a43\u00c0\u008d}\u0088\u00abjDj\u0000\u00ab\u00ab\u00ab\u008d\u0085D\u00ff\u00ff\u00ffP\u00e8T\u00fd\u00ff\u00ff\u0083\u00c4\f\u00ffu\u00a0j\u0000h\u00ff\u00ff\u001f\u0000\u00ffU\u009c\u0089E\u00bc\u0085\u00c0uO\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0\u000f\u0085\u00af\u0000\u0000\u0000PPj\u0002PPh\u0000\u0000\u0000@S\u0089E\u00b8\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft\u0005\u008dE\u00b8\u00eb^\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00e9\u0084\u0000\u0000\u0000\u0083e\u00ec\u0000\u008dM\u00ecQP\u00ffU\u0098\u0081}\u00ec\u0003\u0001\u0000\u0000to\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0uOPPj\u0002PPh\u0000\u0000\u0000@S\u0089E\b\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft*\u008dE\bP\u00ffu\u00b0VW\u00ffU\u00acW\u00ffU\u00f0\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u00eb\n\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0001\u00ffu\u00bc\u00ffU\u00f0\u0080}\u000b\u0000\u000f\u0084\u00e5\u00fe\u00ff\u00ff_^[\u00c9\u00c3\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00c4;A\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000}\u0088-\u009a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x000001d4",
"base_address": "0x00410000"
},
"time": 1602104034.00025,
"tid": 2468,
"flags": {}
},
"pid": 2244,
"type": "call",
"cid": 769
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2648,
"buffer": "\u00c4\b\u0000\u0000C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e8\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0098\u00f8\u0018\u0000|\u00f9\u0018\u0000\u0000\u0000\u0000\u0000|\u00f9\u0018\u0000P,\u00dcu\u0000\u0000\u0000\u0000|,\u00dcuP\u00c9\u00bd)\u0004\u00fa\u0018\u0000\u0000\u0000y\u0002\u0000\u0000\u0000\u0000$\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080ig\u00ff\u00ff\u00ff\u00ff\u00ff\u0000\u0000\u0000\u0000$\u00f9\u0018\u0000\b\u00fa\u0018\u0000\u00c4\u00ff\u0018\u0000\u00e0^\u00deu\u00d4H{\\\u00fe\u00ff\u00ff\u00ff|,\u00dcu 5\u00dcu\u00e8\u0003\u0000",
"process_handle": "0x000001d4",
"base_address": "0x00420000"
},
"time": 1602104034.00025,
"tid": 2468,
"flags": {}
},
"pid": 2244,
"type": "call",
"cid": 772
}
],
"references": [],
"name": "injection_write_memory"
},
{
"markcount": 1,
"families": [],
"description": "Code injection by writing an executable or DLL to the memory of another process",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0006\u0000>hs\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u0002\u0001\u000b\u0001\u000e\u0010\u0000\u0004\u0001\u0000\u0000\u0096\u0000\u0000\u0000\u0000\u0000\u00008W\u0000\u0000\u0000\u0010\u0000\u0000\u0000 \u0001\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00d0\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000@\u0085\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\\I\u0001\u0000\u0018\u0001\u0000\u0000\u0000\u0080\u0001\u0000p,\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00b0\u0001\u0000d\r\u0000\u0000\u00e0G\u0001\u0000\u001c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0001\u0000@\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u0014\u0003\u0001\u0000\u0000\u0010\u0000\u0000\u0000\u0004\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.rdata\u0000\u0000\u00f2:\u0000\u0000\u0000 \u0001\u0000\u0000<\u0000\u0000\u0000\b\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.data\u0000\u0000\u0000@\u001d\u0000\u0000\u0000`\u0001\u0000\u0000\u0006\u0000\u0000\u0000D\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000p,\u0000\u0000\u0000\u0080\u0001\u0000\u0000.\u0000\u0000\u0000J\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.reloc\u0000\u0000d\r\u0000\u0000\u0000\u00b0\u0001\u0000\u0000\u000e\u0000\u0000\u0000x\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000B.bss\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u00c0\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0086\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11965
}
],
"references": [],
"name": "injection_write_memory_exe"
},
{
"markcount": 1,
"families": [],
"description": "Creates a windows hook that monitors keyboard input (keylogger)",
"severity": 3,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "SetWindowsHookExW",
"return_value": 11600565,
"arguments": {
"thread_identifier": 0,
"callback_function": "0x00000000ffe9ae10",
"module_address": "0x00000000ffdf0000",
"hook_identifier": 13
},
"time": 1602104068.2035,
"tid": 1828,
"flags": {
"hook_identifier": "WH_KEYBOARD_LL"
}
},
"pid": 1788,
"type": "call",
"cid": 1501
}
],
"references": [],
"name": "infostealer_keylogger"
},
{
"markcount": 2,
"families": [],
"description": "Used NtSetContextThread to modify a thread in a remote process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2816 called NtSetContextThread to modify thread in remote process 2244",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000010c",
"registers": {
"eip": 0,
"esp": 0,
"edi": 0,
"eax": 4216632,
"ebp": 0,
"edx": 0,
"ebx": 2130567168,
"esi": 0,
"ecx": 0
},
"process_identifier": 2244
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11972
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_ntsetcontextthread"
},
{
"markcount": 2,
"families": [],
"description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 2816 resumed a thread in remote process 2244",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000010c",
"suspend_count": 1,
"process_identifier": 2244
},
"time": 1602104029.70325,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11973
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_resumethread"
},
{
"markcount": 17403,
"families": [],
"description": "Executed a process and injected code into it, probably while unpacking",
"severity": 5,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 2468,
"thread_handle": "0x0000010c",
"process_identifier": 2244,
"current_directory": "",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"track": 1,
"command_line": "\"C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin\" ",
"filepath_r": "C:\\Users\\cuck\\AppData\\Local\\Temp\\6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75.bin",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000104",
"inherit_handles": 0
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 11961
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtGetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000010c"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11962
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtUnmapViewOfSection",
"return_value": 0,
"arguments": {
"process_identifier": 2244,
"region_size": 4096,
"process_handle": "0x00000104",
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11963
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2244,
"region_size": 118784,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000104",
"allocation_type": 12288,
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 11964
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0006\u0000>hs\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u0002\u0001\u000b\u0001\u000e\u0010\u0000\u0004\u0001\u0000\u0000\u0096\u0000\u0000\u0000\u0000\u0000\u00008W\u0000\u0000\u0000\u0010\u0000\u0000\u0000 \u0001\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00d0\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000@\u0085\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\\I\u0001\u0000\u0018\u0001\u0000\u0000\u0000\u0080\u0001\u0000p,\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00b0\u0001\u0000d\r\u0000\u0000\u00e0G\u0001\u0000\u001c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0001\u0000@\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u0014\u0003\u0001\u0000\u0000\u0010\u0000\u0000\u0000\u0004\u0001\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.rdata\u0000\u0000\u00f2:\u0000\u0000\u0000 \u0001\u0000\u0000<\u0000\u0000\u0000\b\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.data\u0000\u0000\u0000@\u001d\u0000\u0000\u0000`\u0001\u0000\u0000\u0006\u0000\u0000\u0000D\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000p,\u0000\u0000\u0000\u0080\u0001\u0000\u0000.\u0000\u0000\u0000J\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@.reloc\u0000\u0000d\r\u0000\u0000\u0000\u00b0\u0001\u0000\u0000\u000e\u0000\u0000\u0000x\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000B.bss\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u00c0\u0001\u0000\u0000\u0002\u0000\u0000\u0000\u0086\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x00400000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11965
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "09a8e6604883628e91c574672b9f0ee31c1efa34",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "",
"process_handle": "0x00000104",
"base_address": "0x00401000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11966
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "9e64f950b21d6bb0ff6a7a90febd768a6b01597c",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "",
"process_handle": "0x00000104",
"base_address": "0x00412000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11967
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "\u0000\u0000\u0000\u0000m\u0011@\u0000\u008f\u0011@\u0000\u009e\u0011@\u0000\u00ad\u0011@\u0000\u00bc\u0011@\u0000\u00cb\u0011@\u0000\u00da\u0011@\u0000\u00fc\u0011@\u0000\u000b\u0012@\u0000 \u0012@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0001\u0001\u0001\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0099T\u00cd<\u00a8\u0087\u0010K\u00a2\u0015`\u0088\u0088\u00dd;UB\u00c4\u00f4K\u008a\u009b\u00a0A\u00b3\u0080\u00ddJpM\u00db(H\u00bb\u00ef\u00be\u00ad\u00de\u00ef\u00be\u00ad\u00deH\u00b8\u00ef\u00be\u00ad\u00de\u00ef\u00be\u00ad\u00de\u00ff\u00e3\u0000\u0000\u00b8\u00ef\u00be\u00ad\u00de\u00e9\u00ef\u00be\u00ad\u00de\u0000\u0000\u0000\u0000\u0000\u0000U\u008b\u00ec\u008bU\u0010\u008bE\b\u008b\u00c8\u0085\u00d2t\t\u00c6\u0001\u0000A\u0083\u00ea\u0001u\u00f7]\u00c3U\u008b\u00ecd\u00a10\u0000\u0000\u0000\u0083\u00ec\u0018\u008b@\fSVW\u008bx\f\u00e9\u00a7\u0000\u0000\u0000\u008bG03\u00f6\u008b_,\u008b?\u0089E\u00f8\u008bB<\u0089}\u00f4\u008bD\u0010x\u0089E\u00f0\u0085\u00c0\u000f\u0084\u0085\u0000\u0000\u0000\u00c1\u00eb\u00103\u00c9\u0085\u00dbt-\u008b}\u00f8\u000f\u00be\u0014\u000f\u00c1\u00ce\r\u0080<\u000fa\u0089U\u00f8|\t\u008b\u00c2\u0083\u00c0\u00e0\u0003\u00f0\u00eb\u0003\u0003u\u00f8A;\u00cbr\u00df\u008bU\u00fc\u008b}\u00f4\u008bE\u00f0\u008bL\u0010\u00183\u00db\u008bD\u0010 \u0003\u00c2\u0089M\u00ec\u0085\u00c9t<\u008b\b3\u00ff\u0003\u00ca\u0083\u00c0\u0004\u0089M\u00f8\u008b\u00d1\u0089E\u00e8\u008a\n\u00c1\u00cf\r\u000f\u00be\u00c1\u0003\u00f8B\u0084\u00c9u\u00f1\u008bU\u00fc\u0089}\u00f8\u008bE\u00f8\u008b}\u00f4\u0003\u00c6;E\bt \u008bE\u00e8C;]\u00ecr\u00c4\u008bW\u0018\u0089U\u00fc\u0085\u00d2\u000f\u0085K\u00ff\u00ff\u00ff3\u00c0_^[\u00c9\u00c2\u0004\u0000\u008bu\u00f0\u008bD\u0016$\u008d\u0004X\u000f\u00b7\f\u0010\u008bD\u0016\u001c\u008d\u0004\u0088\u008b\u0004\u0010\u0003\u00c2\u00eb\u00ddU\u008b\u00ec\u0081\u00ec\u00bc\u0000\u0000\u0000\u008bE\bSVW\u008b\b\u008dX\u0004hLw&\u0007\u0089M\u00a0\u0089]\u00b8\u00e8\u00e8\u00fe\u00ff\u00ff\u008b\u00f0\u00c7E\u00c4kern3\u00c0\u00c7E\u00c8el32\u0088E\u00d0\u0088E\u00de\u008dE\u00c4P\u00c7E\u00cc.dll\u00c7E\u00e0ntdl\u00c7E\u00e4l.dlf\u00c7E\u00e8l\u0000\u00c7E\u00d4user\u00c7E\u00d832.df\u00c7E\u00dcllf\u00c7E\u00f81\u0000f\u00c7E\u00fc2\u0000\u00ff\u00d6\u008dE\u00e0P\u00ff\u00d6\u008dE\u00d4P\u00ff\u00d6hX\u00a4S\u00e5\u00e8y\u00fe\u00ff\u00ffhy\u00cc?\u0086\u0089E\b\u00e8l\u00fe\u00ff\u00ffhE\u0083V\u0007\u0089E\u00f4\u00e8_\u00fe\u00ff\u00ffhD\u00f05\u00e0\u0089E\u00c0\u00e8R\u00fe\u00ff\u00ffh\u00ee\u0095\u00b6P\u0089E\u00a4\u00e8E\u00fe\u00ff\u00ffh\u00c6\u0096\u0087R\u0089E\u009c\u00e88\u00fe\u00ff\u00ffh_xT\u00ee\u0089E\u00f0\u00e8+\u00fe\u00ff\u00ffh\u00da\u00f6\u00daO\u0089E\u0098\u00e8\u001e\u00fe\u00ff\u00ff\u008b\u00f8h\u00c6\u0012\u001ep\u0089}\u00b4\u00e8\u000f\u00fe\u00ff\u00ffh\u00ad\u009e_\u00bb\u008b\u00f0\u00e8\u0003\u00fe\u00ff\u00ffh-W\u00ae[\u0089E\u00bc\u00e8\u00f6\u00fd\u00ff\u00ff\u0089E\u00ac3\u00c0Ph\u0080\u0000\u0000\u0000j\u0003PPh\u0000\u0000\u0000\u0080S\u0089E\u00a8\u00ff\u00d7j\u0000\u0089E\u00ecP\u00ff\u00d6\u008b]\b\u008b\u00f8\u0089}\u00b0j\u0004h\u00000\u0000\u0000Wj\u0000\u00ff\u00d3\u008b\u00f0\u0085\u00f6t\u00eej\u0000\u008dE\u00a8PW\u008b}\u00ecVW\u00ffU\u00bcW\u00ffU\u00f0\u0080>M\u008b]\u00b8t\fj\u0000\u008dE\u00f8PPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0000h\u00e0.\u0000\u0000\u00ffU\u00a43\u00c0\u008d}\u0088\u00abjDj\u0000\u00ab\u00ab\u00ab\u008d\u0085D\u00ff\u00ff\u00ffP\u00e8T\u00fd\u00ff\u00ff\u0083\u00c4\f\u00ffu\u00a0j\u0000h\u00ff\u00ff\u001f\u0000\u00ffU\u009c\u0089E\u00bc\u0085\u00c0uO\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0\u000f\u0085\u00af\u0000\u0000\u0000PPj\u0002PPh\u0000\u0000\u0000@S\u0089E\u00b8\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft\u0005\u008dE\u00b8\u00eb^\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00e9\u0084\u0000\u0000\u0000\u0083e\u00ec\u0000\u008dM\u00ecQP\u00ffU\u0098\u0081}\u00ec\u0003\u0001\u0000\u0000to\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u0085\u00c0uOPPj\u0002PPh\u0000\u0000\u0000@S\u0089E\b\u00ffU\u00b4\u008b\u00f8j\u0000\u0083\u00ff\u00fft*\u008dE\bP\u00ffu\u00b0VW\u00ffU\u00acW\u00ffU\u00f0\u008dE\u0088P\u008d\u0085D\u00ff\u00ff\u00ffP3\u00c0PPPPPPPS\u00ffU\u00f4\u00eb\n\u008dE\u00fcPPj\u0000\u00ffU\u00c0\u00c6E\u000b\u0001\u00ffu\u00bc\u00ffU\u00f0\u0080}\u000b\u0000\u000f\u0084\u00e5\u00fe\u00ff\u00ff_^[\u00c9\u00c3\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00c4;A\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x00416000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11968
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "e7001d804dc89c5e2f67203c78b4ed05b2660ec2",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "",
"process_handle": "0x00000104",
"base_address": "0x00418000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11969
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "\u0000\u0010\u0000\u0000\u0084\u0000\u0000\u0000\u008a0\u00900\u00a00\u00b50\u00bc0\u00c90\u00d00o1u1|1\u00831\u008a1\u00951\u00a41\u00b31\u00c21\u00d11\u00dc1\u00e21\u00e91\u00f01\u00f71\u00022\r2\u00172\"2(2\/262=2D2N2n2\u00f7:\u0002;\r;&;1;<;G;R;];h;\u0087;\u0098;\u00a3;\u00ae;\u00b9;\u00c4;\u00cf;\u00e8;\u00f1;\u0018\u00c7>\u00cf>\u0000\u0000\u0000 \u0000\u0000d\u0000\u0000\u0000\u00ea0\u00d01_4j4\u009f4\u00b54\u00c04\u00dc4\u00e94\u00f94%5,5\u00a35\u00c95\u00dc5\u00fb5m6\u00da6\u00fd6\u00047\u001d7u7\u00f07\u000e8\u00958\u00af8\u00d18\u00f58\u00fb8?9\u00809\u00cb9 ;P;\u00c3;\u00c8;\u00d5;\u00e3;\u00f5;[>\u0092>\u00bd>\u0019?0?~?\u00cf?\u00000\u0000\u0000\u00c0\u0000\u0000\u0000\u001a000N0U0-1A1V1u1\u00901\u009d1\u00b01\u00e21$2\u009b2\u00ef2I3t3\u00b63\u00cd3\u00e83\u001f4\u008b5\u00ce5\r6!616|6\u008c6\u00966\u009d6\u00a66\u00be6\u00f66\u00067'7A7K7W7^7j7q7}7\u00847\u00907\u00977\u00dc7\u00ee7\t8\u00108]8k8|8\u00d48\u00e68\u00ed8\u00f98\u00009\u001a9!91989D9K9W9^9\u00e39\u00fe9S:Z:a:j:\u00e8:\u00ef:\u00fd:\u0006;J;Q;X;a;\u00b2;\u00d8;\/\u00bf>\u00e5>\u00bd?\u00ea?\u0000@\u0000\u0000x\u0000\u0000\u0000\u00ab0\u00d80\u00b41\u00fa1+3X3\u00883\u008e3\u00d43\u00db3\u00cf4\u00045e5\u00cf5K6]6\u00bc6\u00eb6\u0014737<7\u00af8\u00e19\u0004:S;p;\u0091;\u00b2;\u00cc;\u00e9;\u00063>P>m>\u00d7>\u00ed>\u0006?\u001c?\u0013?\u00a5?\u0000\u0000\u0000p\u0000\u0000l\u0001\u0000\u0000\u00880\u00da0\u00b71\u00bf1\u00dd1\u00863\u008c3\u00b03\u00c43\u00d63\u00db3\u00e13\u00e93\u00f63\u001f4&454A4R4k4q4{4\u00824\u008a4\u00904\u009c4\u00a64\u00135+505:5D5N5X5b5l5v5\u00805\u008a5\u00985\u009f5\u00c35\u00e15\u00e85>6H6R6t6~6\u00886\u00b16\u00bb6\u00c56\u00cf6\u00d96\u00f66\u00007\n7\u00147d7n7x7\u00827\u00ab7\u00b07\u00b57\u00c87\u00cd7\u00d27\u00d97\u00e67\u00eb7\u00f07$8)8.888=8B8O8T8Y8f8k8p8}8\u00828\u00878\u00b88\u00c58\u00ca8\u00cf8\u00dc8\u00e18\u00e68\u00f38\u00f88\u00029\u00149!9%9)9-9195999=9A9E9_9\u00919\u00a49\u00bc9\u00d59\u00ee9\u00fb9\u0001:\u0010:8:Z:_:{:\u0081:\u008d:\u009c:\u00a6:\u00b1:\u00ca:\u00d5:\u00da:\u00e9:\u00f5:\t;\u0014;\u001d;\u0086;\u00a3;\u00d9;\u00f6;\u0007<3<[\u0012>\u0018>$><>M>W>`>\u0083>\u00b2>\u00f4>\u0085?\u009f?\u0000\u0080\u0000\u0000@\u0001\u0000\u0000$0:0\u00bd0\u00e40\u00f70\u000e1 1%1+131;1F1K1o1\u00841\u00891\u00b21\u000b2,2G2w2~2\u00842\u00a72\u00c02\u00c62\u00d02\u00e52\u00ef2\n3\u001f3=3H3u3\u00813\u00883\u00943\u00a03\u00aa3\u00b03\u00b63\u00c63\u00ce3\u00d43\u00da3\u00e53\u00ed3\u00f43\u00fa3\u00024\r4\u00134\u00184\u001d4)4?4J4V4[4b4l4r4{4\u00814\u00864\u008e4\u00994\u00aa4\u00af4\u00b54\u00c54\u00d64\u00db4\u00e14\u00e64\u00ec4\u00f64\u00fc4\u00015\u000f5\u00145\u001b5!5'5.5;5@5L5Q5^5c5\u00be5%62696F6v6}6K8\u00cd8\u00d88\u00ec8\u00f68\u00ff8\n929:9@9K9i9\u00939\u00a19\u00c79\u00f09,:P:\u00a1:\u00a6:\u00ab:\u00b2:\u0013;\";2;B;R;b;r;\u0082;\u0092;\u00a2;\u00b2;\u00c2;15>|>\u00c0>\u0004?H?\u008c?\u00f9?\u0000\u0090\u0000\u0000t\u0000\u0000\u0000f0\u00d30p1\u00a61\u00d61\u00dd1\u00f81>2g2\u00a22\u00bb2\u00c82\u00ff2\u00973\u00af3\u00d83\u00f23Y4\u00a94\u00e94 5_6\u00dd6\u00e4647w7\u00917\u009e7\u00af7\u00d37\u00ec7\u00f97;8\u00d38\u00eb8\u00149.9\u00959\u00e59%:b:\u00ad;+<2<\u008f<\u00bd<\n=I=\u0095=\u00c7=\u00fa=\u00e2>\u0015?\u0000\u0000\u0000\u00a0\u0000\u0000\u00c8\u0000\u0000\u0000\u001a0f0m0u0\u008a0\u009c0\u00b20\u00c80\u00f30=1\u00c01\u00c91\u00ce1\u00e71\u00002\u0019222K2d2}2\u009c2\u00b72\u00fa2\u00133L3\u00b43\u00c43\u00d73\u00ea3\u00fd3\u00104#464I4e4\u00b94?5\u00ed5\u00f95\t6\u00196)696I6Y6d6w6\u00826\u00986\u00b46\u00d06\u00ec6\b7X8\u00f38\u00f88\u00119*9C9\\9u9\u008e9\u00a79\u00c09\u00e19\u00fa9;:V:\u0091:\u0019;);<;O;b;u;\u0088;\u009b;\u00ae;\u00ca;\u0019< <. >1>C>\u00ad?\u00c8?\u0000\u0000\u0000\u00b0\u0000\u0000\u00f8\u0000\u0000\u0000\u00011\f1\u00111\u001c1-12171A1U1Z1_1m1u1|1\u00821\u00911\u009b1\u00a01\u00a71\u00b81\u00c01\u00c71\u00ce1\u00d51\u00dc1\u00e31D2\u00b12\u00d52$3|3\u008a3\u009b3\u00c53\u00144\/454:4E4J4U4Z4d4z4\u00aa4\u00be4\u00f74\u00015\u00165\/595F5M5S5X5\u00a15\u00c25\u00e95\u00f25\u00076\u00146-6;6U6^6s6\u00806\u008d6\u00976\u00a96\u00b26\u00c06\u00dd6\u00e76\u00007\r7\u001c7&7G7R7e7\u00927\u009f7\u00ac7\u00b97\u00c67\u00d37\u001d8\u00978\u00ec8\u009a9\u00ac9\u00c29\b;1;I;\u00b0;\u00c9;\u0000<)<3\u0014>:>K>\u0090>\u0095>\u00a3>\u00c9>\u00d6>r?\u0098?\u00a5?\u00f1?\u0000\u00c0\u0000\u0000D\u0001\u0000\u000060T0\u00f40\u00c91\u00da142\u00832\u00e72'3Q3]3e3o3u3\u009e3\u00a43\u00aa3\u00b03\u00bb3\u00c13\u00cc3\u00d23\u00dd3\u00e33\u00ee3\u00f43\u00ff3\u00054\u00104\u00164 4&42474=4Q4\\4h4m4t4\u00804\u00864\u008a4\u00904\u00a24\u00bc4\u00db4\u00f44\u00145-5v5\u00c25\u00c75\u00f95\u00166>6I6[6d6m6s6\u00826\u00a16\u00a86\u00b46\u00b96\u00da6\u00f76\u00fc6\u00027\u000e7\u00187\u001d7>7S7Y7e7m7w7}7\u00847\u008a7\u00ab7\u00b07\u00b57\u00bb7\u00c17\u00cb7\u00d07\u00e77\u00fd7&8;8W8d8p8\u00878\u00e28\u00ef8\"9R9\u00ca9P:^:\u008c:\u00a0:\u00ad:\u00be:\u00fa:8;F;];|;\u008f;\u00ad;\u000f<\u0014<\u001b< <)<\/<4\u0007>\u000e>\u0012>.>4>]>d>r>\u0087>\u008f>\u00ec>0?\u008e?\u0095?\u0000\u00d0\u0000\u0000\u00b8\u0000\u0000\u0000$0\u009d0\u00d10\u00ea0\u00fc0$151C1i1|1\u00b71\u00c71\u00cf1\u0007242D2M2T2\u00832\u00932\u009c2\u00a32 3E3O3]3\u00833\u00aa3\u00f73\b4=4]4q4}4\u00c24\u00d84\u00fa4\u00125O5t5\u00845\u008d5\u0094587?7]7r7\u00867\u00a17\u00cb7\u00fc7\u00078&8@8\u00818\u008a8\u00b68\u00c18\u00ea8\u0013919?9\u00939\u00a59\u00c99<:~: ;\u008a;\u00b1;\u00e1;[<\u0088<\u009e<\u00ad<\u00d2<\u00e2<\u0010=k=s={=\u0086=\u0092=\u009d=\u00b2=\u00ba=\u00ca=\u0000\u0000\u0000\u00e0\u0000\u0000p\u0000\u0000\u0000\u000b2J2\u00013\u00173+3?3\u00bc4\u00b45W6n6\u00836\u008d6\u009a6\u00017+70787?7\u00847\u00997\u00b17\u00bc7\u00cd7\u00e97\u00f97\u00028W8p8{8\u00e58\u001b9J9n9u9\u00d29\u00e49%:H:{:\u00a5:\u00d3:\u00f6:9;\u0081;\u009c;\u0090<\u00b8<\u00e3=\">@>^>\u0000\u0000\u0000\u00f0\u0000\u0000\u00fc\u0000\u0000\u0000@0F0\u00b30\u00c00\u00cd0=1F1T1o1\u00991\u00ad1\u00bb1\u00c21\u00c91\u00012\u000e2+20272D2M2V2l2~2\u00842\u00922\u009b2\u00a52\u00af2\u00b62\u00893\u00a23\u00ce3\u00e73\u00154:4X4`4{4\u00954\u00c94\u00e14\u000b5F5]5d5\u00f75\u00026\u00136\u001a6<6C6g6u6|6\u00836\u00c06\u00cf6\u00037\u000e7,7?7^7h77\u00bf7\u00c67\u00de7\u000b8\u0018828=8\t959t9\u00959}:\u0088:\u0091:\u00a1:\u00a8:\u00ae:\u00b7:\u00c2:\u00cb:\u00ef:\u00fa:\u0000;\u000f;\u0015;\u001f;%;);L;R;W;k;w;;\u0085;\u0098;\u00f6;\u0010o>\u0085>\u008a>\u00a2>\u00d3>\u00db>\u00ef>\u00fe>\u001b?8?\u0000\u0000\u0001\u0000\u00e8\u0000\u0000\u0000\u0019050A0I0U0l0\u00940\u00b10\u00be0\u00d50w1\u009b1\u00a81\u00b01\u00c31\u00e21\u0016414:4C4I4^4\u00944\u009d4\u00a34\u00b44\u00c24\u00dc4\u00f34\u00cd5\u00126\u00cd6\u00e16\"7-777A7K7v7\u00897\u00947\u00aa7\u00d27\u00e47\u00eb7\u00148\u001b8i8y8\u008d8\u00c68\u00cb8\u00d8899M9@:l:\u00ab:\u00ca:\u00d5:\u00e4:\u00ee:\u00fd:\u0007;\u0011;g;l;z;\u0089;+<2\u001b>%>\/>9>\u0087>\u00a2>\u00ac>\u00bb>\u00c1>\u00d0>\u00eb>\u00f5>\u0004?\n?\u0019?4?>?M?S?b?}?\u0087?\u0092?\u0098?\u00a4?\u00bf?\u00c9?\u00d4?\u00da?\u00e4?\u0000\u0010\u0001\u0000X\u0000\u0000\u0000\u00000\n0\u00140\u001e0(060;0@0E0J0\u00ae0\u00cb0\u00e80\u00071&1:1T1[1k1r1\u009c1b2n2u2{2\u00842\u00892\u009c2\u00a12\u00a62\u00ab2\u00b22\u00b92\u00bd2\u00c32\u00e12\u00eb2\u00f62\u00013\u000b3\u0000 \u0001\u0000\u00c0\u0000\u0000\u0000 4$4\u00b44\u00b84\u00bc4\u00c04\u00c44\u00c84\u00cc4\u00d04\u00d44\u00d84\u00dc4\u00e04\u00e44\u00e84\u00ec4\u00f04\u00f44\u00f84\u00fc4\u00005\u00045\b5\f5\u00105\u00145\u00185\u001c5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5\u00805\u00845\u00885\u008c5\u00905\u00945\u00985\u009c5\u00a05\u00a45\u00a85\u00ac5\u00b05\u00b45\u00b85\u00bc5\u00c05\u00c45\u00c85\u00cc5\u00d05\u00d45\u00d85\u00dc5\u00e05\u00e45\u00e85\u00ec5\u00f05\u00f45\u00f85\u00fc5\u00006\u00046\b6\f6\u00106\u00146\u00186\u00000\u0001\u0000\u0014\u0000\u0000\u0000\u00a4;\u00a8;\u00ac;\u00c4;\u00c8;\u00cc;\u0000@\u0001\u00008\u0000\u0000\u0000\u00046\b6`6d6h6l6p6\u00a46\u00a86\u00e46\u00e86\u00fc6\u00007\u00047\b7|7\u00807\u00847\u00887\u008c7\u00907\u00947\u00987\u0000\u0000\u0000`\u0001\u0000 \u0000\u0000\u0000\u00040\b0\f0\u00100\u00140\u00180\u001c0 0$0(0x5\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x0041b000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11970
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2244,
"buffer": "2\u0000\u0000\u0000\u00bd\u009cJ1\u0097\">sknR\u00a0\u0090\u00d6\u00d5\u00fc\u001c\u00a6\u00e2H\u00e0T\u0015I$|\u00c5\u0097\u0085\u009e\u0003\u00c3\u00efwG\u0098\u00d6iA\u00ce\u00ca'\u009faz|i\u00f3\u0085\u00ba(\u0090\u0095\u00f6\u00bf\"'|\u009c\u00bbz2`_Ur\u0007\u00de\u00e5A%\u00ef\u00e8\u00d3\u00c0\u00fbC\u00f4\u0003\u009c3\u0080\u00af\u00ab\u00f3\u0018\u00a0?!\u00ef\u0013\u00fejL\u001b\u00e2b\u00ab\u00b7\u0099\u008a\u0085\u00ebP\u00ca\u00c7@\b\u00f3\u00d6\u00f4nol}\u00b7\u00a7\r\u00b9\u00b2\u0001\u00fb\u00b9\u00fb\u00f7\u0017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x00000104",
"base_address": "0x0041c000"
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11971
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtSetContextThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000010c",
"registers": {
"eip": 0,
"esp": 0,
"edi": 0,
"eax": 4216632,
"ebp": 0,
"edx": 0,
"ebx": 2130567168,
"esi": 0,
"ecx": 0
},
"process_identifier": 2244
},
"time": 1602104029.65625,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11972
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x0000010c",
"suspend_count": 1,
"process_identifier": 2244
},
"time": 1602104029.70325,
"tid": 2420,
"flags": {}
},
"pid": 2816,
"type": "call",
"cid": 11973
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15609
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10410000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15611
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15613
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10420000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15615
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15617
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10430000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15619
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15621
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10440000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15623
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15625
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10450000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15627
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15629
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10460000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15631
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15633
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10470000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15635
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15637
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10480000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15639
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15641
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10490000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15643
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15645
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104a0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15647
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15649
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104b0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15651
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15653
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104c0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15655
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15657
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104d0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15659
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15661
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104e0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15663
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15665
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x104f0000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15667
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15669
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10500000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15671
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15673
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10510000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15675
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15677
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "NtAllocateVirtualMemory",
"return_value": 3221225480,
"arguments": {
"process_identifier": 0,
"region_size": 114688,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x00000000",
"allocation_type": 12288,
"base_address": "0x10520000"
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2816,
"type": "call",
"cid": 15679
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741809,
"api": "CreateProcessInternalW",
"return_value": 0,
"arguments": {
"thread_identifier": 0,
"thread_handle": "0x00000000",
"process_identifier": 0,
"current_directory": "",
"filepath": "",
"track": 0,
"command_line": "RdpSaUacHelper.exe",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x00000000",
"inherit_handles": 0
},
"time": 1602104030.20325,
"tid": 2420,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 2816,
"type": "call",
"cid": 15681
}
],
"references": [],
"name": "injection_runpe"
}
] Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.0778119564056396,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5226,
"time": 9.078718900680542,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7070,
"time": 3.039834976196289,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7398,
"time": 1.0106208324432373,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7726,
"time": 3.05222487449646,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8054,
"time": 1.5174219608306885,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8382,
"time": -0.09361600875854492,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8710,
"time": 1.5469858646392822,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28120,
"time": 1.0474488735198975,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36504,
"time": 3.1248269081115723,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "7344da25bcfa6c76607ee5e2506e41b152b6ed5d50af50ffe238ebe50e1674ad",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "f9227432095c071b6bb2638ef5313660d7b63b9b2224ac29f659510de1df6238",
"irc": [],
"https_ex": []
}Screenshots
monday.exe removal instructions
The instructions below shows how to remove monday.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the monday.exe file for removal, restart your computer and scan it again to verify that monday.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate monday.exe in the scan result and tick the checkbox next to the monday.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate monday.exe in the scan result.
c:\downloads\monday.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the monday.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If monday.exe still remains in the scan result, proceed with the next step. If monday.exe is gone from the scan result you're done.
- If monday.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that monday.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 6de123b0b87042ebe4f4e6615e23b8b5 |
| SHA256 | 6c04db2aca35149205b81bfe1a0e00792dfc2091ce9e743d82caa8643ad4ea75 |
Error Messages
These are some of the error messages that can appear related to monday.exe:
monday.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
monday.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
Hidden Start (64-bit) has stopped working.
End Program - monday.exe. This program is not responding.
monday.exe is not a valid Win32 application.
monday.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with monday.exe?
To help other users, please let us know what you will do with monday.exe:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.