{ "statistics": { "processing": [ { "name": "CAPE", "time": 4.495 }, { "name": "AnalysisInfo", "time": 0.046 }, { "name": "BehaviorAnalysis", "time": 0.058 }, { "name": "Debug", "time": 0.002 }, { "name": "NetworkAnalysis", "time": 0.004 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "antivm_network_adapters", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "guloader_apis", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "koadic_apis", "time": 0.0 }, { "name": "koadic_network_activity", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "cryptbot_network", "time": 0.0 }, { "name": "masslogger_artifacts", "time": 0.0 }, { "name": "purplewave_network_activity", "time": 0.0 }, { "name": "quilclipper_behavior", "time": 0.0 }, { "name": "raccoon_behavior", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "vidar_behavior", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "loader_alien", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "encrypt_pcinfo", "time": 0.0 }, { "name": "encrypt_data_agenttesla_http", "time": 0.0 }, { "name": "encrypt_data_agentteslat2_http", "time": 0.0 }, { "name": "encrypt_data_nanocore", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "nemty_network_activity", "time": 0.0 }, { "name": "nemty_note", "time": 0.0 }, { "name": "sodinokibi_behavior", "time": 0.0 }, { "name": "stop_ransomware_registry", "time": 0.0 }, { "name": "blackrat_apis", "time": 0.0 }, { "name": "blackrat_network_activity", "time": 0.0 }, { "name": "blackrat_registry_keys", "time": 0.0 }, { "name": "dcrat_behavior", "time": 0.0 }, { "name": "karagany_system_event_objects", "time": 0.0 }, { "name": "rat_luminosity", "time": 0.0 }, { "name": "rat_nanocore", "time": 0.0 }, { "name": "netwire_behavior", "time": 0.0 }, { "name": "obliquerat_network_activity", "time": 0.0 }, { "name": "orcusrat_behavior", "time": 0.0 }, { "name": "trochilusrat_apis", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "remcos_shell_code_dynamic_wrapper_x", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "neshta_files", "time": 0.0 }, { "name": "neshta_regkeys", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.0 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.0 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.0 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.002 }, { "name": "antianalysis_detectreg", "time": 0.002 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.004 }, { "name": "antiav_detectreg", "time": 0.011 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.0 }, { "name": "antivm_generic_bios", "time": 0.0 }, { "name": "antivm_generic_diskreg", "time": 0.001 }, { "name": "antivm_hyperv_keys", "time": 0.0 }, { "name": "antivm_parallels_keys", "time": 0.001 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.002 }, { "name": "antivm_vbox_keys", "time": 0.001 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.001 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.0 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.001 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "gulpix_behavior", "time": 0.0 }, { "name": "ketrican_regkeys", "time": 0.0 }, { "name": "okrum_mutexes", "time": 0.0 }, { "name": "banker_cridex", "time": 0.0 }, { "name": "geodo_banking_trojan", "time": 0.001 }, { "name": "banker_spyeye_mutexes", "time": 0.0 }, { "name": "banker_zeus_mutex", "time": 0.0 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.0 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "carberp_mutex", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "cypherit_mutexes", "time": 0.0 }, { "name": "darkcomet_regkeys", "time": 0.0 }, { "name": "datop_loader", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.001 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.001 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "andromut_mutexes", "time": 0.0 }, { "name": "downloader_cabby", "time": 0.0 }, { "name": "phorpiex_mutexes", "time": 0.0 }, { "name": "protonbot_mutexes", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "apocalypse_stealer_file_behavior", "time": 0.0 }, { "name": "arkei_files", "time": 0.0 }, { "name": "azorult_mutexes", "time": 0.001 }, { "name": "infostealer_bitcoin", "time": 0.002 }, { "name": "cryptbot_files", "time": 0.0 }, { "name": "echelon_files", "time": 0.001 }, { "name": "infostealer_ftp", "time": 0.005 }, { "name": "infostealer_im", "time": 0.003 }, { "name": "infostealer_mail", "time": 0.002 }, { "name": "masslogger_files", "time": 0.0 }, { "name": "poullight_files", "time": 0.001 }, { "name": "purplewave_mutexes", "time": 0.0 }, { "name": "quilclipper_mutexes", "time": 0.0 }, { "name": "qulab_files", "time": 0.001 }, { "name": "qulab_mutexes", "time": 0.0 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.004 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.001 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.001 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.0 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.0 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powerpool_mutexes", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "cryptomix_mutexes", "time": 0.0 }, { "name": "dharma_mutexes", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.004 }, { "name": "ransomware_files", "time": 0.007 }, { "name": "fonix_mutexes", "time": 0.0 }, { "name": "gandcrab_mutexes", "time": 0.0 }, { "name": "germanwiper_mutexes", "time": 0.0 }, { "name": "medusalocker_mutexes", "time": 0.0 }, { "name": "medusalocker_regkeys", "time": 0.0 }, { "name": "nemty_mutexes", "time": 0.0 }, { "name": "nemty_regkeys", "time": 0.0 }, { "name": "pysa_mutexes", "time": 0.0 }, { "name": "ransomware_radamant", "time": 0.0 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "revil_mutexes", "time": 0.001 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "satan_mutexes", "time": 0.0 }, { "name": "snake_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransomware_cmd", "time": 0.0 }, { "name": "ransomware_stopdjvu", "time": 0.0 }, { "name": "rat_beebus_mutexes", "time": 0.0 }, { "name": "blacknet_mutexes", "time": 0.0 }, { "name": "blackrat_mutexes", "time": 0.0 }, { "name": "crat_mutexes", "time": 0.0 }, { "name": "dcrat_files", "time": 0.0 }, { "name": "dcrat_mutexes", "time": 0.0 }, { "name": "rat_fynloski_mutexes", "time": 0.0 }, { "name": "limerat_mutexes", "time": 0.0 }, { "name": "limerat_regkeys", "time": 0.0 }, { "name": "lodarat_file_behavior", "time": 0.0 }, { "name": "modirat_behavior", "time": 0.0 }, { "name": "njrat_regkeys", "time": 0.0 }, { "name": "obliquerat_files", "time": 0.0 }, { "name": "obliquerat_mutexes", "time": 0.0 }, { "name": "parallax_mutexes", "time": 0.0 }, { "name": "rat_pcclient", "time": 0.0 }, { "name": "rat_plugx_mutexes", "time": 0.0 }, { "name": "rat_poisonivy_mutexes", "time": 0.0 }, { "name": "rat_quasar_mutexes", "time": 0.0 }, { "name": "ratsnif_mutexes", "time": 0.0 }, { "name": "rat_spynet", "time": 0.0 }, { "name": "venomrat_mutexes", "time": 0.0 }, { "name": "warzonerat_files", "time": 0.0 }, { "name": "warzonerat_regkeys", "time": 0.0 }, { "name": "xpertrat_files", "time": 0.0 }, { "name": "xpertrat_mutexes", "time": 0.0 }, { "name": "rat_xtreme_mutexes", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.001 }, { "name": "remcos_files", "time": 0.0 }, { "name": "remcos_mutexes", "time": 0.0 }, { "name": "remcos_regkeys", "time": 0.0 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.001 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "spicyhotpot_behavior", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.001 }, { "name": "tampers_etw", "time": 0.001 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "targeted_flame", "time": 0.001 }, { "name": "territorial_disputes_sigs", "time": 0.009 }, { "name": "trickbot_mutex", "time": 0.0 }, { "name": "fleercivet_mutex", "time": 0.0 }, { "name": "lokibot_mutexes", "time": 0.001 }, { "name": "ursnif_behavior", "time": 0.001 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "neshta_mutexes", "time": 0.0 }, { "name": "renamer_mutexes", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.006 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.006 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 }, { "name": "allaple_mutexes", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "test_win.bat", "path": "/opt/CAPEv2/storage/binaries/6f7caa9e033886dc9944c6dc966a7730833622b21570d45e2da206b180083f55", "guest_paths": "", "size": 93, "crc32": "C684FC53", "md5": "80465455b46676f45790ee8f73e75059", "sha1": "c364111154e6e2b24642399b5af52b0af075e36e", "sha256": "6f7caa9e033886dc9944c6dc966a7730833622b21570d45e2da206b180083f55", "sha512": "f41341eed78727192abc5d32f013b2e4f097807a6072c94c02931d30e44b4feb536a968a29e3f9389da634c1683680779e1b5b2834b67fff8209c08ad7fa1c17", "rh_hash": null, "ssdeep": "3:mKDDro+Lzjoue4FAq6xgjxFV2gjiLDzn:hnVLnouZOq6xaHM/", "type": "DOS batch file, ASCII text", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1C2B0120FF0962D73C3E1CC7428800441380C17E7C850CC2161C7193404C14C0328E931", "sha3_384": "a577b851bc168daef4672eec933ca9a2e6416931389cb36e85a469d75d776e017f93ab1d54578bb7a3a63c2b14f13e92", "yara_hash": "fe117167fbd534878f0d9e7ac29fa46e0f54b9514e7874201773b1e16ed71c1a", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "@echo off\necho CAPE Test Sample\necho Hostname: %COMPUTERNAME%\necho User: %USERNAME%\nipconfig\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "" } }, "procdump": [ { "name": "b77a8d902a6d61b3739f4c1fbad4d7a19e54f8538a340bf68df594a6b72d23a8", "path": "/opt/CAPEv2/storage/analyses/5/procdump/b77a8d902a6d61b3739f4c1fbad4d7a19e54f8538a340bf68df594a6b72d23a8", "guest_paths": "1;?C:\\Windows\\SysWOW64\\cmd.exe;?C:\\Windows\\SysWOW64\\cmd.exe;?", "size": 346624, "crc32": "375FF4EA", "md5": "5f8d26672e84f86f1eca2842ab85f86a", "sha1": "31fe24dd11c4536b7641dea8c6381594cc96e38c", "sha256": "b77a8d902a6d61b3739f4c1fbad4d7a19e54f8538a340bf68df594a6b72d23a8", "sha512": "63195c37647c2a14627c221fc45a6cfe3c602e44eb445ca9d8c161c3827a02678f45add431732cb464fc274728c11747ed8deeb320915f08adb425553ac4153a", "rh_hash": null, "ssdeep": "6144:+2Clk/Le5fbg2d29QPZsy3uZvuvUttSEQ2mtQme:+2CsLetbg3A/+Jryqn", "type": "PE32 executable (console) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T16C747C12B34890F0CA622174557AF7339C7DBE358755A2C7A7E05E6B78A03C2B53C36A", "sha3_384": "07c2052c6228a7535d63b5ef04688669b2e6622b7de0b417315c21414358199c2b8a0b06312477f3d4c53ee1a5843fe8", "yara_hash": "fe117167fbd534878f0d9e7ac29fa46e0f54b9514e7874201773b1e16ed71c1a", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "This file format cannot be verified because it is not recognized.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00b20000", "entrypoint": "0x00016b20", "ep_bytes": "e8d0050000e9d9fdffffcccccccccccc", "peid_signatures": null, "reported_checksum": "0x00046aec", "actual_checksum": "0x00062d62", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "cmd.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0xb6a314", "name": "__dllonexit" }, { "address": "0xb6a318", "name": "_unlock" }, { "address": "0xb6a31c", "name": "_lock" }, { "address": "0xb6a320", "name": "_initterm" }, { "address": "0xb6a324", "name": "wcsspn" }, { "address": "0xb6a328", "name": "_tell" }, { "address": "0xb6a32c", "name": "_except_handler4_common" }, { "address": "0xb6a330", "name": "__setusermatherr" }, { "address": "0xb6a334", "name": "__p__fmode" }, { "address": "0xb6a338", "name": "_cexit" }, { "address": "0xb6a33c", "name": "_exit" }, { "address": "0xb6a340", "name": "__set_app_type" }, { "address": "0xb6a344", "name": "__getmainargs" }, { "address": "0xb6a348", "name": "_amsg_exit" }, { "address": "0xb6a34c", "name": "__p__commode" }, { "address": "0xb6a350", "name": "_XcptFilter" }, { "address": "0xb6a354", "name": "calloc" }, { "address": "0xb6a358", "name": "free" }, { "address": "0xb6a35c", "name": "_purecall" }, { "address": "0xb6a360", "name": "__CxxFrameHandler3" }, { "address": "0xb6a364", "name": "?terminate@@YAXXZ" }, { "address": "0xb6a368", "name": "_wcslwr" }, { "address": "0xb6a36c", "name": "_controlfp" }, { "address": "0xb6a370", "name": "_dup2" }, { "address": "0xb6a374", "name": "memcmp" }, { "address": "0xb6a378", "name": "_local_unwind4" }, { "address": "0xb6a37c", "name": "_dup" }, { "address": "0xb6a380", "name": "??1type_info@@UAE@XZ" }, { "address": "0xb6a384", "name": "_close" }, { "address": "0xb6a388", "name": "_open_osfhandle" }, { "address": "0xb6a38c", "name": "swscanf" }, { "address": "0xb6a390", "name": "_ultoa" }, { "address": "0xb6a394", "name": "_pipe" }, { "address": "0xb6a398", "name": "memmove" }, { "address": "0xb6a39c", "name": "wcsncmp" }, { "address": "0xb6a3a0", "name": "_setmode" }, { "address": "0xb6a3a4", "name": "exit" }, { "address": "0xb6a3a8", "name": "_getch" }, { "address": "0xb6a3ac", "name": "iswspace" }, { "address": "0xb6a3b0", "name": "wcschr" }, { "address": "0xb6a3b4", "name": "iswxdigit" }, { "address": "0xb6a3b8", "name": "_setjmp3" }, { "address": "0xb6a3bc", "name": "time" }, { "address": "0xb6a3c0", "name": "srand" }, { "address": "0xb6a3c4", "name": "_wtol" }, { "address": "0xb6a3c8", "name": "fflush" }, { "address": "0xb6a3cc", "name": "wcsstr" }, { "address": "0xb6a3d0", "name": "iswalpha" }, { "address": "0xb6a3d4", "name": "wcstoul" }, { "address": "0xb6a3d8", "name": "??3@YAXPAX@Z" }, { "address": "0xb6a3dc", "name": "_errno" }, { "address": "0xb6a3e0", "name": "??_V@YAXPAX@Z" }, { "address": "0xb6a3e4", "name": "printf" }, { "address": "0xb6a3e8", "name": "memcpy_s" }, { "address": "0xb6a3ec", "name": "_onexit" }, { "address": "0xb6a3f0", "name": "fgets" }, { "address": "0xb6a3f4", "name": "qsort" }, { "address": "0xb6a3f8", "name": "rand" }, { "address": "0xb6a3fc", "name": "_pclose" }, { "address": "0xb6a400", "name": "fprintf" }, { "address": "0xb6a404", "name": "wcsrchr" }, { "address": "0xb6a408", "name": "ferror" }, { "address": "0xb6a40c", "name": "realloc" }, { "address": "0xb6a410", "name": "towlower" }, { "address": "0xb6a414", "name": "setlocale" }, { "address": "0xb6a418", "name": "towupper" }, { "address": "0xb6a41c", "name": "_wcsupr" }, { "address": "0xb6a420", "name": "feof" }, { "address": "0xb6a424", "name": "_wpopen" }, { "address": "0xb6a428", "name": "_wcsnicmp" }, { "address": "0xb6a42c", "name": "_get_osfhandle" }, { "address": "0xb6a430", "name": "longjmp" }, { "address": "0xb6a434", "name": "iswdigit" }, { "address": "0xb6a438", "name": "wcstol" }, { "address": "0xb6a43c", "name": "_vsnwprintf" }, { "address": "0xb6a440", "name": "_wcsicmp" }, { "address": "0xb6a444", "name": "__iob_func" }, { "address": "0xb6a448", "name": "malloc" }, { "address": "0xb6a44c", "name": "_callnewh" }, { "address": "0xb6a450", "name": "??0exception@@QAE@ABQBD@Z" }, { "address": "0xb6a454", "name": "??0exception@@QAE@ABQBDH@Z" }, { "address": "0xb6a458", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0xb6a45c", "name": "??1exception@@UAE@XZ" }, { "address": "0xb6a460", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0xb6a464", "name": "_CxxThrowException" }, { "address": "0xb6a468", "name": "memcpy" }, { "address": "0xb6a46c", "name": "memset" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0xb6a474", "name": "NtOpenProcessToken" }, { "address": "0xb6a478", "name": "NtQueryInformationToken" }, { "address": "0xb6a47c", "name": "NtClose" }, { "address": "0xb6a480", "name": "NtOpenThreadToken" }, { "address": "0xb6a484", "name": "NtFsControlFile" }, { "address": "0xb6a488", "name": "RtlDosPathNameToNtPathName_U" }, { "address": "0xb6a48c", "name": "RtlFindLeastSignificantBit" }, { "address": "0xb6a490", "name": "RtlFreeHeap" }, { "address": "0xb6a494", "name": "RtlReleaseRelativeName" }, { "address": "0xb6a498", "name": "NtOpenFile" }, { "address": "0xb6a49c", "name": "RtlDosPathNameToRelativeNtPathName_U_WithStatus" }, { "address": "0xb6a4a0", "name": "NtSetInformationFile" }, { "address": "0xb6a4a4", "name": "NtQueryVolumeInformationFile" }, { "address": "0xb6a4a8", "name": "NtSetInformationProcess" }, { "address": "0xb6a4ac", "name": "NtQueryInformationProcess" }, { "address": "0xb6a4b0", "name": "RtlNtStatusToDosError" }, { "address": "0xb6a4b4", "name": "NtCancelSynchronousIoFile" }, { "address": "0xb6a4b8", "name": "RtlCreateUnicodeStringFromAsciiz" }, { "address": "0xb6a4bc", "name": "RtlFreeUnicodeString" } ] }, "api-ms-win-core-kernel32-legacy-l1-1-0": { "dll": "api-ms-win-core-kernel32-legacy-l1-1-0.dll", "imports": [ { "address": "0xb6a15c", "name": "GetConsoleWindow" }, { "address": "0xb6a160", "name": "CopyFileW" } ] }, "api-ms-win-core-libraryloader-l1-2-0": { "dll": "api-ms-win-core-libraryloader-l1-2-0.dll", "imports": [ { "address": "0xb6a168", "name": "GetProcAddress" }, { "address": "0xb6a16c", "name": "GetModuleFileNameA" }, { "address": "0xb6a170", "name": "LoadLibraryExW" }, { "address": "0xb6a174", "name": "GetModuleHandleW" }, { "address": "0xb6a178", "name": "GetModuleHandleExW" }, { "address": "0xb6a17c", "name": "GetModuleFileNameW" } ] }, "api-ms-win-core-synch-l1-1-0": { "dll": "api-ms-win-core-synch-l1-1-0.dll", "imports": [ { "address": "0xb6a27c", "name": "WaitForSingleObject" }, { "address": "0xb6a280", "name": "TryAcquireSRWLockExclusive" }, { "address": "0xb6a284", "name": "CreateSemaphoreExW" }, { "address": "0xb6a288", "name": "CreateMutexExW" }, { "address": "0xb6a28c", "name": "OpenSemaphoreW" }, { "address": "0xb6a290", "name": "AcquireSRWLockShared" }, { "address": "0xb6a294", "name": "ReleaseSRWLockShared" }, { "address": "0xb6a298", "name": "InitializeCriticalSection" }, { "address": "0xb6a29c", "name": "EnterCriticalSection" }, { "address": "0xb6a2a0", "name": "ReleaseSemaphore" }, { "address": "0xb6a2a4", "name": "ReleaseSRWLockExclusive" }, { "address": "0xb6a2a8", "name": "LeaveCriticalSection" }, { "address": "0xb6a2ac", "name": "ReleaseMutex" }, { "address": "0xb6a2b0", "name": "WaitForSingleObjectEx" } ] }, "api-ms-win-core-heap-l1-1-0": { "dll": "api-ms-win-core-heap-l1-1-0.dll", "imports": [ { "address": "0xb6a128", "name": "HeapAlloc" }, { "address": "0xb6a12c", "name": "HeapSetInformation" }, { "address": "0xb6a130", "name": "HeapReAlloc" }, { "address": "0xb6a134", "name": "GetProcessHeap" }, { "address": "0xb6a138", "name": "HeapSize" }, { "address": "0xb6a13c", "name": "HeapFree" } ] }, "api-ms-win-core-errorhandling-l1-1-0": { "dll": "api-ms-win-core-errorhandling-l1-1-0.dll", "imports": [ { "address": "0xb6a07c", "name": "SetLastError" }, { "address": "0xb6a080", "name": "GetLastError" }, { "address": "0xb6a084", "name": "SetErrorMode" }, { "address": "0xb6a088", "name": "UnhandledExceptionFilter" }, { "address": "0xb6a08c", "name": "SetUnhandledExceptionFilter" } ] }, "api-ms-win-core-processthreads-l1-1-0": { "dll": "api-ms-win-core-processthreads-l1-1-0.dll", "imports": [ { "address": "0xb6a1f0", "name": "GetStartupInfoW" }, { "address": "0xb6a1f4", "name": "GetCurrentThreadId" }, { "address": "0xb6a1f8", "name": "CreateProcessW" }, { "address": "0xb6a1fc", "name": "CreateProcessAsUserW" }, { "address": "0xb6a200", "name": "UpdateProcThreadAttribute" }, { "address": "0xb6a204", "name": "InitializeProcThreadAttributeList" }, { "address": "0xb6a208", "name": "GetExitCodeProcess" }, { "address": "0xb6a20c", "name": "TerminateProcess" }, { "address": "0xb6a210", "name": "GetCurrentProcessId" }, { "address": "0xb6a214", "name": "GetCurrentProcess" }, { "address": "0xb6a218", "name": "DeleteProcThreadAttributeList" }, { "address": "0xb6a21c", "name": "OpenThread" }, { "address": "0xb6a220", "name": "ResumeThread" } ] }, "api-ms-win-core-localization-l1-2-0": { "dll": "api-ms-win-core-localization-l1-2-0.dll", "imports": [ { "address": "0xb6a184", "name": "GetLocaleInfoW" }, { "address": "0xb6a188", "name": "FormatMessageW" }, { "address": "0xb6a18c", "name": "SetThreadLocale" }, { "address": "0xb6a190", "name": "GetACP" }, { "address": "0xb6a194", "name": "GetThreadLocale" }, { "address": "0xb6a198", "name": "GetUserDefaultLCID" }, { "address": "0xb6a19c", "name": "GetCPInfo" } ] }, "api-ms-win-core-debug-l1-1-0": { "dll": "api-ms-win-core-debug-l1-1-0.dll", "imports": [ { "address": "0xb6a05c", "name": "OutputDebugStringW" }, { "address": "0xb6a060", "name": "IsDebuggerPresent" }, { "address": "0xb6a064", "name": "DebugBreak" } ] }, "api-ms-win-core-handle-l1-1-0": { "dll": "api-ms-win-core-handle-l1-1-0.dll", "imports": [ { "address": "0xb6a11c", "name": "CloseHandle" }, { "address": "0xb6a120", "name": "DuplicateHandle" } ] }, "api-ms-win-core-memory-l1-1-0": { "dll": "api-ms-win-core-memory-l1-1-0.dll", "imports": [ { "address": "0xb6a1a4", "name": "VirtualFree" }, { "address": "0xb6a1a8", "name": "VirtualAlloc" }, { "address": "0xb6a1ac", "name": "VirtualQuery" }, { "address": "0xb6a1b0", "name": "ReadProcessMemory" } ] }, "api-ms-win-core-console-l1-1-0": { "dll": "api-ms-win-core-console-l1-1-0.dll", "imports": [ { "address": "0xb6a008", "name": "ReadConsoleW" }, { "address": "0xb6a00c", "name": "WriteConsoleW" }, { "address": "0xb6a010", "name": "GetConsoleMode" }, { "address": "0xb6a014", "name": "SetConsoleMode" }, { "address": "0xb6a018", "name": "SetConsoleCtrlHandler" }, { "address": "0xb6a01c", "name": "GetConsoleOutputCP" } ] }, "api-ms-win-core-file-l1-1-0": { "dll": "api-ms-win-core-file-l1-1-0.dll", "imports": [ { "address": "0xb6a094", "name": "ReadFile" }, { "address": "0xb6a098", "name": "GetFileAttributesW" }, { "address": "0xb6a09c", "name": "GetFileSize" }, { "address": "0xb6a0a0", "name": "SetFilePointer" }, { "address": "0xb6a0a4", "name": "GetFullPathNameW" }, { "address": "0xb6a0a8", "name": "GetVolumePathNameW" }, { "address": "0xb6a0ac", "name": "CreateFileW" }, { "address": "0xb6a0b0", "name": "WriteFile" }, { "address": "0xb6a0b4", "name": "SetFilePointerEx" }, { "address": "0xb6a0b8", "name": "FindFirstFileExW" }, { "address": "0xb6a0bc", "name": "GetDiskFreeSpaceExW" }, { "address": "0xb6a0c0", "name": "FileTimeToLocalFileTime" }, { "address": "0xb6a0c4", "name": "CompareFileTime" }, { "address": "0xb6a0c8", "name": "RemoveDirectoryW" }, { "address": "0xb6a0cc", "name": "FindFirstFileW" }, { "address": "0xb6a0d0", "name": "GetFileType" }, { "address": "0xb6a0d4", "name": "FindNextFileW" }, { "address": "0xb6a0d8", "name": "FindClose" }, { "address": "0xb6a0dc", "name": "GetVolumeInformationW" }, { "address": "0xb6a0e0", "name": "SetFileTime" }, { "address": "0xb6a0e4", "name": "DeleteFileW" }, { "address": "0xb6a0e8", "name": "SetEndOfFile" }, { "address": "0xb6a0ec", "name": "SetFileAttributesW" }, { "address": "0xb6a0f0", "name": "CreateDirectoryW" }, { "address": "0xb6a0f4", "name": "GetDriveTypeW" }, { "address": "0xb6a0f8", "name": "FlushFileBuffers" }, { "address": "0xb6a0fc", "name": "GetFileAttributesExW" } ] }, "api-ms-win-core-string-l1-1-0": { "dll": "api-ms-win-core-string-l1-1-0.dll", "imports": [ { "address": "0xb6a264", "name": "WideCharToMultiByte" }, { "address": "0xb6a268", "name": "MultiByteToWideChar" } ] }, "api-ms-win-core-processenvironment-l1-1-0": { "dll": "api-ms-win-core-processenvironment-l1-1-0.dll", "imports": [ { "address": "0xb6a1b8", "name": "SetEnvironmentStringsW" }, { "address": "0xb6a1bc", "name": "GetStdHandle" }, { "address": "0xb6a1c0", "name": "SetEnvironmentVariableW" }, { "address": "0xb6a1c4", "name": "GetCurrentDirectoryW" }, { "address": "0xb6a1c8", "name": "FreeEnvironmentStringsW" }, { "address": "0xb6a1cc", "name": "ExpandEnvironmentStringsW" }, { "address": "0xb6a1d0", "name": "GetEnvironmentVariableW" }, { "address": "0xb6a1d4", "name": "GetEnvironmentStringsW" }, { "address": "0xb6a1d8", "name": "SetCurrentDirectoryW" }, { "address": "0xb6a1dc", "name": "SearchPathW" }, { "address": "0xb6a1e0", "name": "GetCommandLineW" } ] }, "api-ms-win-core-console-l2-1-0": { "dll": "api-ms-win-core-console-l2-1-0.dll", "imports": [ { "address": "0xb6a024", "name": "SetConsoleTextAttribute" }, { "address": "0xb6a028", "name": "GetConsoleScreenBufferInfo" }, { "address": "0xb6a02c", "name": "FillConsoleOutputAttribute" }, { "address": "0xb6a030", "name": "FlushConsoleInputBuffer" }, { "address": "0xb6a034", "name": "FillConsoleOutputCharacterW" }, { "address": "0xb6a038", "name": "SetConsoleCursorPosition" }, { "address": "0xb6a03c", "name": "ScrollConsoleScreenBufferW" } ] }, "api-ms-win-security-base-l1-1-0": { "dll": "api-ms-win-security-base-l1-1-0.dll", "imports": [ { "address": "0xb6a304", "name": "RevertToSelf" }, { "address": "0xb6a308", "name": "GetSecurityDescriptorOwner" }, { "address": "0xb6a30c", "name": "GetFileSecurityW" } ] }, "api-ms-win-core-sysinfo-l1-1-0": { "dll": "api-ms-win-core-sysinfo-l1-1-0.dll", "imports": [ { "address": "0xb6a2c0", "name": "GetSystemTimeAsFileTime" }, { "address": "0xb6a2c4", "name": "GetSystemTime" }, { "address": "0xb6a2c8", "name": "GetTickCount" }, { "address": "0xb6a2cc", "name": "SetLocalTime" }, { "address": "0xb6a2d0", "name": "GetLocalTime" }, { "address": "0xb6a2d4", "name": "GetVersion" }, { "address": "0xb6a2d8", "name": "GetWindowsDirectoryW" } ] }, "api-ms-win-core-timezone-l1-1-0": { "dll": "api-ms-win-core-timezone-l1-1-0.dll", "imports": [ { "address": "0xb6a2ec", "name": "FileTimeToSystemTime" }, { "address": "0xb6a2f0", "name": "SystemTimeToFileTime" } ] }, "api-ms-win-core-datetime-l1-1-0": { "dll": "api-ms-win-core-datetime-l1-1-0.dll", "imports": [ { "address": "0xb6a050", "name": "GetTimeFormatW" }, { "address": "0xb6a054", "name": "GetDateFormatW" } ] }, "api-ms-win-core-systemtopology-l1-1-0": { "dll": "api-ms-win-core-systemtopology-l1-1-0.dll", "imports": [ { "address": "0xb6a2e0", "name": "GetNumaHighestNodeNumber" }, { "address": "0xb6a2e4", "name": "GetNumaNodeProcessorMaskEx" } ] }, "api-ms-win-core-console-l2-2-0": { "dll": "api-ms-win-core-console-l2-2-0.dll", "imports": [ { "address": "0xb6a044", "name": "SetConsoleTitleW" }, { "address": "0xb6a048", "name": "GetConsoleTitleW" } ] }, "api-ms-win-core-processenvironment-l1-2-0": { "dll": "api-ms-win-core-processenvironment-l1-2-0.dll", "imports": [ { "address": "0xb6a1e8", "name": "NeedCurrentDirectoryForExePathW" } ] }, "api-ms-win-core-registry-l1-1-0": { "dll": "api-ms-win-core-registry-l1-1-0.dll", "imports": [ { "address": "0xb6a240", "name": "RegSetValueExW" }, { "address": "0xb6a244", "name": "RegCreateKeyExW" }, { "address": "0xb6a248", "name": "RegOpenKeyExW" }, { "address": "0xb6a24c", "name": "RegQueryValueExW" }, { "address": "0xb6a250", "name": "RegCloseKey" }, { "address": "0xb6a254", "name": "RegDeleteValueW" }, { "address": "0xb6a258", "name": "RegDeleteKeyExW" }, { "address": "0xb6a25c", "name": "RegEnumKeyExW" } ] }, "api-ms-win-core-file-l2-1-0": { "dll": "api-ms-win-core-file-l2-1-0.dll", "imports": [ { "address": "0xb6a104", "name": "CreateSymbolicLinkW" }, { "address": "0xb6a108", "name": "GetFileInformationByHandleEx" }, { "address": "0xb6a10c", "name": "MoveFileExW" }, { "address": "0xb6a110", "name": "MoveFileWithProgressW" }, { "address": "0xb6a114", "name": "CreateHardLinkW" } ] }, "api-ms-win-core-heap-l2-1-0": { "dll": "api-ms-win-core-heap-l2-1-0.dll", "imports": [ { "address": "0xb6a144", "name": "GlobalFree" }, { "address": "0xb6a148", "name": "GlobalAlloc" }, { "address": "0xb6a14c", "name": "LocalFree" } ] }, "api-ms-win-core-io-l1-1-0": { "dll": "api-ms-win-core-io-l1-1-0.dll", "imports": [ { "address": "0xb6a154", "name": "DeviceIoControl" } ] }, "api-ms-win-core-winrt-l1-1-0": { "dll": "api-ms-win-core-winrt-l1-1-0.dll", "imports": [ { "address": "0xb6a2f8", "name": "RoInitialize" }, { "address": "0xb6a2fc", "name": "RoUninitialize" } ] }, "api-ms-win-core-processtopology-l1-1-0": { "dll": "api-ms-win-core-processtopology-l1-1-0.dll", "imports": [ { "address": "0xb6a228", "name": "GetThreadGroupAffinity" } ] }, "api-ms-win-core-synch-l1-2-0": { "dll": "api-ms-win-core-synch-l1-2-0.dll", "imports": [ { "address": "0xb6a2b8", "name": "Sleep" } ] }, "api-ms-win-core-profile-l1-1-0": { "dll": "api-ms-win-core-profile-l1-1-0.dll", "imports": [ { "address": "0xb6a238", "name": "QueryPerformanceCounter" } ] }, "api-ms-win-core-string-obsolete-l1-1-0": { "dll": "api-ms-win-core-string-obsolete-l1-1-0.dll", "imports": [ { "address": "0xb6a270", "name": "lstrcmpW" }, { "address": "0xb6a274", "name": "lstrcmpiW" } ] }, "api-ms-win-core-processtopology-obsolete-l1-1-0": { "dll": "api-ms-win-core-processtopology-obsolete-l1-1-0.dll", "imports": [ { "address": "0xb6a230", "name": "SetProcessAffinityMask" } ] }, "api-ms-win-core-apiquery-l1-1-0": { "dll": "api-ms-win-core-apiquery-l1-1-0.dll", "imports": [ { "address": "0xb6a000", "name": "ApiSetQueryApiSetPresence" } ] }, "api-ms-win-core-delayload-l1-1-1": { "dll": "api-ms-win-core-delayload-l1-1-1.dll", "imports": [ { "address": "0xb6a074", "name": "ResolveDelayLoadedAPI" } ] }, "api-ms-win-core-delayload-l1-1-0": { "dll": "api-ms-win-core-delayload-l1-1-0.dll", "imports": [ { "address": "0xb6a06c", "name": "DelayLoadFailureHook" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0004a4c8", "size": "0x000002f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0004e000", "size": "0x000084f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00057000", "size": "0x000025f0" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x000035a0", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000015d0", "size": "0x000000ac" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x0002cd9c", "size": "0x00000080" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x0002d000", "size_of_data": "0x0002c000", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.58" }, { "name": ".data", "raw_address": "0x0002c400", "virtual_address": "0x0002e000", "virtual_size": "0x0001c000", "size_of_data": "0x0001b200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.12" }, { "name": ".idata", "raw_address": "0x00047600", "virtual_address": "0x0004a000", "virtual_size": "0x00003000", "size_of_data": "0x00002600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.68" }, { "name": ".didat", "raw_address": "0x00049c00", "virtual_address": "0x0004d000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.68" }, { "name": ".rsrc", "raw_address": "0x00049e00", "virtual_address": "0x0004e000", "virtual_size": "0x00009000", "size_of_data": "0x00008600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "4.36" }, { "name": ".reloc", "raw_address": "0x00052400", "virtual_address": "0x00057000", "virtual_size": "0x00003000", "size_of_data": "0x00002600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.80" } ], "overlay": null, "resources": [ { "name": "MUI", "offset": "0x00056420", "size": "0x000000d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.68" }, { "name": "RT_ICON", "offset": "0x0004e778", "size": "0x00000668", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.65" }, { "name": "RT_ICON", "offset": "0x0004ede0", "size": "0x000002e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.44" }, { "name": "RT_ICON", "offset": "0x0004f0c8", "size": "0x00000128", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.17" }, { "name": "RT_ICON", "offset": "0x0004f1f0", "size": "0x00000ea8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.06" }, { "name": "RT_ICON", "offset": "0x00050098", "size": "0x000008a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.07" }, { "name": "RT_ICON", "offset": "0x00050940", "size": "0x00000568", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.71" }, { "name": "RT_ICON", "offset": "0x00050ea8", "size": "0x0000169e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.85" }, { "name": "RT_ICON", "offset": "0x00052548", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.88" }, { "name": "RT_ICON", "offset": "0x00054af0", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.97" }, { "name": "RT_ICON", "offset": "0x00055b98", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.17" }, { "name": "RT_GROUP_ICON", "offset": "0x00056000", "size": "0x00000092", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.90" }, { "name": "RT_VERSION", "offset": "0x00056098", "size": "0x00000388", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.50" }, { "name": "RT_MANIFEST", "offset": "0x0004e350", "size": "0x00000426", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.00" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Command Processor" }, { "name": "FileVersion", "value": "10.0.19041.746 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "cmd" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "Cmd.Exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.746" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "392b4d61b1d1dadc1f06444df258188a", "timestamp": "2102-04-20 00:53:43", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAACp0lEQVR4nO2ZPW/TQByHH8cpUyWQ2NjKd+AjNK1U1ZGQkBjZYWNhQAIEUmFgKuwsSEhISElV0TeoVFUsnSLUgS6J2nRJA0mTpknss8OQ2thN3Z7Tl5ORH+lyf/sud7+fz3e+OJCQkBBrNIDnL2ceaZo2q1qMDJ1O+/HMqxfvAAvopQE0TZu9e+++MlHvP+QAePgge+bxl8+f3gIfgRpgpq9a7Em4QmWPgetAC78BPZWiUS2f2Vkv+BG5/Hidftav2/PlbvJz89ZtN0wDKTfon0nrzLx+868TXwMnxbLJcZyB2M2FENi2jRACy7K83DRN2u02nU4Hy7I8TT9/lQYuRir0MsUEz8Dx4YoLp45APp8nn8+Hli8sLFy4oKiEGsjlchiGgWEYzM3Neefn5+cD9RYXFy9PnQRSc2B6etqLp6amvHhychKApaWlC5Ylz7kn8cTEBADLy8vnFjMMUgZOu4UAMpkMACsrKxckSx7vOXB8Ecpms94EDruF/IyPjwdGYXV1NbTT0dFRAG/Nd9F1HV3XA88LaQPVWmOg0DCMMxsAME2TWq3G2NgYzWaTRqOBpmlS3/Vj2za2bYeWV37vD5wbei/UbDapVCrs7e1Rr9eHbebcRDIghGBnZ4dSqcTh4eFlaYqElIGDgwOKxSK7u7sIIS5bUyRONSCEYGtri2KxKDWhVOBbhYLLULlcZnNzk263e+WiojAwAo7jUCgU2N7eVqEnMgEDpmmysbFBtVpVpScyngHH6bG2tkar1VKpJzLeVkLYduzEw//0iyyuJAZUkxhQTWJANYkB1cTeQGA3+u1HQZWOoUkD7NfrmfXvX9W9XovAs6dP7gBdQMDRf2TACHDjKI2oEBaBLvAHaAC2a0CjPxrXAF2RMFkEfRPhL5ASEhLiw1+s5V9Z8HnusgAAAABJRU5ErkJggg==", "icon_hash": "00d152c1523e56c619d25f6c96c21a41", "icon_fuzzy": "e55641fba39eaff4ee89e5fc0af8f337", "icon_dhash": "a2ae7a370101a3c0", "imported_dll_count": 37 }, "data": null, "strings": [ "SetThreadLocale", "2]3i3{3", "=q?{?", "WNetGetConnectionWStub", "OutputDebugStringW", ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC", "3/363G3", "9n9z9", "2$2_2e2l2", "RWRVh", "v", ")030`0", "%hs(%d) tid(%x) %08X %ws", "host_unreachable", "__p__commode", "UnhandledExceptionFilter", "yy/MM/dd", "5;5B5j5", "RtlCreateUnicodeStringFromAsciiz", "4I4X4", "api-ms-win-core-heap-l1-1-0.dll", "address in use", "no_buffer_space", "cross device link", "?what@exception@@UBEPBDXZ", "connection_aborted", "no stream resources", "<1<6", "CMDEXTVERSION", "uBSWR", "QShc#", "VS_VERSION_INFO", "80J0f0u0", "t$ WWWV", "D$xPh", "%2d%s%02d%s%02d%s%02d", "t$0j ", "WGeToken: (%x) '%s'", "FindFirstFileExW", ">x?}?", "_exit", "4'5A5", "YYf9}", "LeaveCriticalSection", "%02d%s%02d%s", "ASSOC", "en-US", "timed_out", "api-ms-win-core-file-l1-1-0.dll", "onecore\\base\\cmd\\StartShellExecServiceProvider.h", "j.Yf;", "GetTickCount", "RtlNtStatusToDosError", ":%:,:::C:z:", ";$;-;5;T;Z;", "1B1N1i1t1", "BrandingFormatString", ".?AVout_of_range@std@@", "u&QWS", "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", "GlobalAlloc", "%s %s ", "SVWt j", " /D /c\"", ">9?R?d?", ".data$pr00", "L$(t:", "VirtualAlloc", " %x %c", " /K %s", "GetTimeFormatW", "COLOR", ">&?.?D?L?i?s?", "CreateMutexExW", "SetConsoleTextAttribute", "j\\^f9q", "DebugBreak", "no such device or address", " &()[]{}^=;!%'+,`~", "<\"<'<7<", "connection aborted", "848B8b8g8", "D$(PV", ":=:C:M:S:\\:a:", "0123456789", " ", "argument list too long", ".gljmp", "C0K0Q0W0j0{0", "ReadProcessMemory", "NtQueryInformationProcess", "not connected", "_vsnwprintf", "wcschr", "REM /?", "<%", "MessageBeepStub", "iostream", "@$9Q w", "7.9\\9", "91:;:L:`:j:{:", "ProductName", "1,1q1!2'2]2", "D$LPV", "6.6A6I6m6s6y6", "v(h(4", "VPSRW", "api-ms-win-core-synch-l1-1-0.dll", "NtSetInformationProcess", "t%j\\Xf;", "message_size", "host unreachable", "6h7l7p7t7x7", "", "9/:z:", "2Q2W2]2c2h2n2", "1#101O1\\1x1", "b$j-0", "QSVWj", " name=\"Microsoft.Windows.FileSystem.CMD\"", ":#:(:8:n:{:", "<;O>\\>", ";';9;I;O;q;", ";4;L;`;d;x;|;", "f;D$,u", "EXIST", "D$,SVW", "D$hP3", "_XcptFilter", "797Y7", "3C3O3m3", "x]j:Xf", "GetLocaleInfoW", "ntdll.dll", "????????.???", "6&616f6{6", "Yj f;", "is a directory", "WNetCancelConnection2WStub", ">(>P>f>s>", "<>+-*/%()|^&=,", "3(343@3L3", "D$xPj", "_wpopen", "skip=", "operation canceled", "0=0Q0W0", "323<3", ".?AVbad_alloc@std@@", "NDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD", "041=1O1X1", "1e1j1", "<5<=", "_amsg_exit", "api-ms-win-security-base-l1-1-0.dll", " v,PW", "Se%ae`", "=,;+/[] ", "rmdir ", "t+Vh5#", "@PVVWSQ", "=0I0N0j0q0", "=\"=F=J=N=R=V=Z=^=b=f=j=", "7 848v8{8Q9v9", "__set_app_type", "SetFileAttributesW", "Redir: ", ">i?y?", "HIGHESTNUMANODENUMBER", ">3>P>b>", "invalid argument", "GetProcessHeap", "j\"Zf;", "", "GetNumaHighestNodeNumber", "api-ms-win-core-string-obsolete-l1-1-0.dll", ":X:l:", ".CRT$XCU", "FindClose", ".rsrc", "RegDeleteValueW", "*** Unknown type: %x", "FillConsoleOutputCharacterW", "j\\Yf;", "Cmd: %s Type: %x ", "GetDateFormatW", ".text", "tbhX ", "SetEndOfFile", "VarFileInfo", "t5PPQh", "realloc", "=W>]>", "t*h0$", " \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"", "j\"ZRV", "RRRRP%", "?Q?V?m?", "405h5", "PathCompletionChar", "address_not_available", ">*>t>{>", "D$`PV", "too many files open", "D$&PVj", "4N4m4}4", "=9=@=U=\\=l=v=", "FlushFileBuffers", "operation would block", "__iob_func", "696^6", "cmd.pdb", ".idata$4", "?*?E?K?", "T$$;T$", "GetWindowsDirectoryW", "1'141>1L1a1", "GetDiskFreeSpaceExW", "D$hPQj", " ", "L$8Q3", "DeleteFileW", "t$Sh4&", "3)4P4`4", ";2Windows Command Processor", "FileTimeToLocalFileTime", "7D7U7[7a7|7", "u\"j:Xf9F", "j\\Xf9", "owner dead", "SetConsoleCursorPosition", "2 2&2-222=2m2s2", "no such process", "D3blc", "GetConsoleOutputCP", "; ;&;+;1;7;K;V;[;a;g;", "iH4-N", ".data$brc", "FailFast", "9t$$~n", "9):B:Q:", "BREAK", "8.8X8", ".text$di", "START", "1$1,141<1D1L1T1\\1d1l1t1|1", "bad file descriptor", "6!6'6-636=6L6R6Z6y6~6", "5G5U5b5", "0/0A0", "ENABLEEXTENSIONS", ">+>>>B>F>J>N>R>V>Z>^>b>u>", "9L:~;", "@PVVWS", "api-ms-win-core-synch-l1-2-0.dll", ">Q>_>t>{>", ".didat$4", ".text$yd", "filename too long", "CMDCMDLINE", "\\Shell\\Open\\Command", ";O;^;v;};", ".CRT$XIY", "DefaultColor", "j\\^f91", "GlobalFree", "directory not empty", "network_reset", "swscanf", "4h4t4", "8<8K8", ":):R:", "6,7E7M7", "Copyright (c) Microsoft Corporation. All rights reserved.", "interrupted", ":$:-:", "resource deadlock would occur", "j:Zf;", "3H4`4o4", "RegOpenKeyExW", "VShb#", "Software\\Classes", "api-ms-win-core-libraryloader-l1-2-0.dll", "D$ Ph", "j Xf9DN", "VPj#S", "91:K:\\:", "MKLINK", " version=\"5.1.0.0\"", "PATHEXT", "WNetAddConnection2WStub", "YY8\\$", "cCBR_p", "7c7u7", "3c4p4", ".didat$6", "GetFullPathNameW", "j\\Yf9", "tDSSSS", "F>^>s>", "NTDLL.DLL", "_except_handler4_common", "4)4G4", "timed out", ":.;^;", ")>4>H>", "8B9_9z9", "j.Xf9", "7)7x7", "5>5R5", "6?6I6Y6e6", "RemoveDirectoryW", "<3=i=v=", "FreeEnvironmentStringsW", "='=5=C=T=\\=r=z=", "=.=?=L=Z=r={=", "_setjmp3", "=L>h>", "(%s) %s ", "bad message", "<$;X;", "j\"Yf;", " true", "fflush", "api-ms-win-core-delayload-l1-1-0.dll", "not supported", "8#828A8F8Z8i8", "0$0,040<0D0L0T0X0\\0`0d0h0l0p0t0x0|0", "WWWSQ", "connection refused", "7H8e8", "3D3X3l3", "lext-ms-win-cmd-util-l1-1-0", "wrong_protocol_type", "NtQueryInformationToken", "C:\\Users\\malware\\AppData\\Local\\Temp", "inappropriate io control operation", "VVVVR", "DEFINED", "\\XCOPY.EXE", "j-[f;", "GetLocalTime", "131w1W3]3z3", "network reset", "[%hs(%hs)]", "Application", "__setusermatherr", "APerformArithmeticOperation: '%c'", "63696F6T6k6", "GetFileSecurityW", "5&5a5", "connection reset", "api-ms-win-core-kernel32-legacy-l1-1-0.dll", "connection_refused", "6!7k7", "<,<4C>Z>o>", "1D2d2z2", "D$(PQ", "WriteFile", "GetVDMCurrentDirectoriesStub", "not_connected", "D$D;D$,", ":S:`:", "delims=", "2!2'2W2w2", "j=Xf9", "operation_not_supported", "j:Yf9H", "ShellExecuteExW", "PAUSE", ".data", "SetFilePointer", "=)>A>", ".giats", "GetEnvironmentVariableW", "address family not supported", ";2;I;R;];d;v;|;", "CompletionChar", "010@0N0U0", "iWWSQ", "7&7-7=7S7Z7f7}7", "T$tRP", ".bss$zz", "IF /?", ">:>h>", "NtOpenProcessToken", "too_many_files_open", "WSh!'", "Exception", "3!3)3;3A3", "t$true", "connection already in progress", "4'40474>4Y4c4l4v4", "9T:Z:", ".data$00", "L$XQ3", "_initterm", "829Q9^:", "4W5d5s5", "NtOpenFile", "0!1q1", "EnterCriticalSection", "Msg:[%ws] ", "f;D$d", "!This program cannot be run in DOS mode.", "GetVersion", "", "WilError_03", "pqacG%%apppppppaB", ".text$mn", "f;D$$u", "ext-ms-win-branding-winbrand-l1-2-0", "ReleaseSRWLockExclusive", "no message", "4$4.464B4J4X4`4", "NtClose", "`j/Yf;", "GetProcAddress", "314V4n4", "already_connected", "u3SSh,<", "NQ>", "7!8,8L8q8{8", "3_3s3", "1#1*1", "9U:r:", "6)60676V6}6", "tef93t`", "6 6W6", "VERIFY", "SVWj/X", "api-ms-win-core-winrt-l1-1-0.dll", "FindNextStreamWStub", "address not available", "MultiByteToWideChar", "j:Xf9", "7I7h7", "5?6X6", "DIRCMD", "1$131<1E1Z1o1~1", "FormatMessageW", "NEWWINDOW", "*tr;]", "tEht&", "[%hs]", "j:Xf9F", "api-ms-win-core-processenvironment-l1-1-0.dll", "@Qm6t", "MM/dd/yy", "0>0r0", "(caller: %p) ", "not a directory", "HeapReAlloc", "ReleaseMutex", "9!9<9s9", "HeapAlloc", "??0exception@@QAE@ABQBD@Z", "6@6`6", "cG?CCRRRRP`R", "onecore\\base\\cmd\\maxpathawarestring.cpp", "wcsspn", " [...]", "0X1]1q1", "969E9", "4Y4,5b5E6", "D$$9L$", "QQh|4", ": :.:G:M:S:Z:`:k:r:", "protocol error", "text file busy", "{~WPh", "lstrcmpiW", "2%232C2N2e2z2", "SetLastError", "6\"6(6,6?6D6U6s6y6", "ext-ms-win-shell-shell32-l1-2-0", "<$=,=<=R=Z=j=~=", " type=\"win32\"", "ext-ms-win-cmd-util-l1-1-0.dll", "connection_reset", "<0W0b0f0r0v0", "no link", ".gfids", "3%4}4", "5G5i5", "QQSVW", "u)Rh7#", "VQh(=", "8::@:T:Z:`:j:t:{:", "4R5]5c5", "t$1N1p1u1", "fprintf", "Software\\Microsoft\\Windows NT\\CurrentVersion", "j$Xf;", "HeapSetInformation", "C:\\Windows\\system32\\cmd.exe", "GetThreadLocale", "j/Xf;", ".text$zz", "GetCurrentProcessId", "9Q9y9", "GetModuleFileNameW", "7(7,7@7D7X7\\7p7t7", "wwwwwwwwwwwwwww", "0(0=0K0T0c0h0m0", "8\"8*82878>8F8U8a8l8", "CMD.EXE", "60676C6Y6a6h6{6", "yuPA{u", "api-ms-win-core-sysinfo-l1-1-0.dll", "4`5d5h5l5p5t5", "798P8q8", "j\"Yf9", "5u6~6", "|$B:tQ", "api-ms-win-core-heap-l2-1-0.dll", "L$xQQ3", "0A0\\0e0k0p0y0", "value too large", "5@6^657T7r7", "D$PSV", "resource unavailable try again", "PU,//", "LoadLibraryExW", "%s %s%s ", "j\\Xf;", "Vj ^S", "_pipe", "iswxdigit", ";Q;p;x;", ";';-;V;g;m;", "6'6\\6", "iswalpha", "ResumeThread", "CopyFileW", "8(8/8G8h8t8z8", "?Rich", "ABOVENORMAL", "NtOpenThreadToken", "9\"949F9M9U9[9n9u9", "operation_would_block", "wcstol", "function not supported", "3-3;3I3", "0_0h0", "PWhl;", "778I8", "4sf9>", "\\$0SP", "X1>>>V>l>", ";b+?9?~?", ";0<7<", "unknown error", "CallContext:[%hs] ", "network_unreachable", "no buffer space", "5(5<5V5]5~5", "?\"?d?p?x?", "SetCurrentDirectoryW", "?=?h?o?z?", "protocol not supported", "929O9U9f9{9F:", "ReleaseSemaphore", ".data$zz", "SetConsoleMode", " [..]", ".text$zs", "DeleteProcThreadAttributeList", "PROMPT", "t$pVQ", "2#3l3", "|$$f9", "FOR /?", "%d.%d.%05d.%d", "DPATH", ".data$r$brc", "WShD#", "Microsoft", "1W1^1", "t5j Y", "9 979F9", "L$,RQh", "qsort", "t\"j*Z", "PSh[#", ".rsrc$02", "tBj0Y", "8\"8'8<8H8O8Z8a8l8s8~8", "OriginalFilename", ":f;w;", "AcquireSRWLockShared", "848<8s8", "_ultoa", "SETLOCAL", "<<=F=Y=c=", "SWhl;", "too many links", "#D$Lt", "GetConsoleWindow", "RegSetValueExW", "0+1b1", "j-Zj/Yf;", "file exists", "invalid_argument", "ENABLEDELAYEDEXPANSION", "SetProcessAffinityMask", "=ExitCodeAscii", "j\\Zj:Yf", "6T6r6", "uCj\\Z", "CompanyName", "RWhl;", "_cexit", "api-ms-win-core-processthreads-l1-1-0.dll", "1>2Z2v2", "63696H6M6U6p6", "DelayedExpansion", "7]8i8v8", "eIDATx", "2>X>e>t>", "979V9]9r9y9", "0<1R1g1v1|1", "<$<8<<<@8R8X8^8p8", ".?AVexception@@", "ext-ms-win-shell-shell32-l1-2-1", "FindFirstFileW", "ctff;", "NtSetInformationFile", "959U9", "GetLastError", "RegCreateKeyExW", "permission denied", "171p1", "2<3E3J3Z3k3t3}3", "ShellExecuteWorker", "GetVolumeInformationW", "CloseHandle", "_callnewh", "not enough memory", ".text$zy", "memcpy", "VVVQV", "575>5F5N5", ".rdata$zz", "mkdir ", ".didat$5", "=;=_=", "GetSecurityDescriptorOwner", "iostream stream error", "??1type_info@@UAE@XZ", "708[8", "9~(s+j", "%04X-%04X", ".text$x", "3*3/3y3", "GetExitCodeProcess", "useback", "StringFileInfo", "t3VSh", "L$\\_^[3", "9 969;9C9e9", "too many symbolic link levels", "RtlFreeUnicodeString", "L$8RQRP", "DuplicateHandle", "?Y?s?", "D$pPS", "Translation", "3G4N4", "api-ms-win-core-debug-l1-1-0.dll", "3*353B3P3Z3d3n3x3", "8\"8<8h8", ".bss$00", "vHYY3", "465Y5s5", "72898E8P8e8", "HH:mm:ss t", "fgets", "D$4Pj", "operation not permitted", "_wcslwr", "operation in progress", ".xdata$x", "", "0 0$0(0,0004080@0", "j=XPV", "no protocol option", "SVWQQj", "api-ms-win-core-datetime-l1-1-0.dll", "w>", "f91t.", "4m4~4", "O8j*Z", "srand", "operation not supported", "%WINDOWS_COPYRIGHT%", "HeapFree", " ", "?!?'?-?A?O?e?", "!>D>L>", "RENAME", "api-ms-win-core-processtopology-obsolete-l1-1-0.dll", "8S8Y8", "GetModuleFileNameA", "GetFileAttributesExW", "*)))))))))))))))))))))", "memcmp", "0 0B0b0", "se%%%%% R", "D$8f90", "0,090", "j%Yf;", "GetStartupInfoW", "<1<:=I=N=", "VSh\\#", "21262>2", "D$`;D$d", "5.5=5J5V5", ";8;m;w;", ";>", "vDhd:", "COMSPEC", "ferror", ";D;H;d;h;x;", "SetThreadUILanguage", "98:4;;;", "=A=W=^=g=", "SetConsoleTitleW", "api-ms-win-core-file-l2-1-0.dll", "4qaCCRCCCB", "memset", "5?5g5n5", "9 9$989<9P9T9h9l9", "D$$Ph", "malloc", "939A9H9{9", ";);B;^;", "REM/?", "ENDLOCAL", "6H7R7f7v7}7", "iswspace", "GetFileType", "0Ph4:", "no such device", " ", "='>9>D>R>_>", "D$|QP", "WaitForSingleObject", ".CRT$XCAA", "SetConsoleInputExeNameW", ">1?9?", "4<4l4t4z4", "message size", "api-ms-win-core-memory-l1-1-0.dll", "u%6RRRRRPp", ":$;4;", "memcpy_s", "t;f9;t6", "j%Xf9", "InitializeProcThreadAttributeList", "j Yf9", ":2;_;", "RShl;", "api-ms-win-core-localization-l1-2-0.dll", " uiAccess=\"false\"", "wwwwwwwwwwwwwwwwwwwww", "%hs!%p: ", ";\\$(r", "destination_address_required", "0\"1R1", "0B0i1", "CreateProcessAsUserW", "tJSh$$", "L$ h(#", "PSh^#", ".rdata$zz$brc", "7Y7k7v7", " Operating System", "FindFirstStreamWStub", "GetFileAttributesW", "GetEnvironmentStringsW", "uqj?Z", "1.13191E1J1P1i1", "5%6+616K6U6a6l6~6", "bad allocation", ".00cfg", ";/;c;", "towlower", "\\CMD.EXE", "j\\Zf9", "_close", "O", "MoveFileExW", "api-ms-win-core-console-l1-1-0.dll", "broken pipe", "no_protocol_option", "VPh]#", "SystemTimeToFileTime", "4r6}6", "474=4G4L4R4`4m4{4", "Wj:Xf9F", "D$H9D$D", "j\\Zj:^f9p", "8<8b8l8q8", "_setmode", "313D3", "D$ PV", "CreateDirectoryW", "api-ms-win-core-timezone-l1-1-0.dll", "wcsrchr", "6%6<6P6g6q6|6", "Sleep", "SetUnhandledExceptionFilter", "'j:Xj.f", "VPh@:", "", "QueryFullProcessImageNameWStub", "__CxxFrameHandler3", "LookupAccountSidWStub", "3*313Z3w3", "939S9d9~9", "2V2]2", "_ _^[", "FileVersion", "j\\Xf9B", "D$dPS", "@_^[]", "t$TShT#", "CreateSemaphoreExW", " 3>C>X?u?", "p>", "SSSSP", "2(2/2H2W2]2m2", "QRRRP", "FindNextFileW", "=-=c=", ":2:C:q:", "", "757S7j7", "Y__^[", ":&:X:", "5Y5z5", "E$uwM", "=ExitCode", "not a stream", "7E7J7`7", "2/2f2o2y2", "D$495", "file too large", "GetThreadGroupAffinity", "_getch", "Software\\Microsoft\\Command Processor", "SetFilePointerEx", "NeedCurrentDirectoryForExePathW", "XXX8Pvh8v", ".idata$2", "api-ms-win-core-io-l1-1-0.dll", "RMDIR", ".?AVlogic_error@std@@", "ExpandEnvironmentStringsW", "7E8O8", "executable format error", "L$xQ3", "7 73787@7\\7", "HeapSize", "SetEnvironmentVariableW", "FileTimeToSystemTime", "3$3,343<3D3L3T3\\3d3l3t3|3", "cmd.exe", "u4h4'", "2$2,242<2D2L2T2\\2d2l2t2|2", "ERASE", "wcsncmp", "string too long", " ", "VirtualFree", "api-ms-win-core-errorhandling-l1-1-0.dll", "RegDeleteKeyExW", ".didat$2", "system", "GetNumaNodeProcessorMaskEx", "io error", "GetConsoleTitleW", ": ;&;W;};", "L$ PSV", "api-ms-win-core-processenvironment-l1-2-0.dll", "m;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32\\Scripts\\;C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32\\;C:\\Users\\malware\\AppData\\Local\\Microsoft\\WindowsApps", "?$?+???I?{?", "1G1^1", "not a socket", "090C0", "ext-ms-win-shell-shell32-l1-2-0.dll", "SetLocalTime", "FOR/?", "090?0H0T0", "%s=%s", "304g4", "DoSHChangeNotify", "KERNEL32.DLL", "979C9S9l9", ".idata", "ApiSetQueryApiSetPresence", "000H0h0", "result out of range", "9 9B9M9_9g9l9q9", "RtlReleaseRelativeName", "CHDIR", "0*1Q1", "T$$9T$", "CmdBatNotificationStub", "FlushConsoleInputBuffer", "SetEnvironmentStringsW", "RtlDisownModuleHeapAllocation", ".idata$3", ".text$np", "not_a_socket", "tokens=", "SEPARATE", "PPWWWQ", "generic", "wrong protocol type", ":(:D:H:d:h:", "argument out of domain", "VirtualQuery", "0B0\\0", "()|&=,;\"", "SaferWorker", "5\"5'5.565F5", "no message available", "api-ms-win-core-profile-l1-1-0.dll", "9s:z:", "NtCancelSynchronousIoFile", "RoUninitialize", "SVWj,", "%s (%s) %s", "4C4H4", "445(6B6k6r6", "%hs(%u)\\%hs!%p: ", "connection_already_in_progress", "longjmp", "PUSHD", "_wtol", "*?H?N?i?n?s?", ".idata$5", "WaitForSingleObjectEx", "7\"7D7K7Q7f7k7s7", "8'8.8H8", "chdir ", "no space on device", "RaiseFailFastException", "6,7B7I7g7n7", "j\"[umf9", "8#9(9U9p9|9", "Cmd.Exe", "SHIFT", "f;D$8u", "__p__fmode", "dd/MM/yy", "_^[]", "GetCurrentProcess", "GetDriveTypeW", "/w(t`", ">8>E>", ".CRT$XIA", "x4j/Z", "InternalName", "Software\\Policies\\Microsoft\\Windows\\System", "api-ms-win-core-console-l2-2-0.dll", "9E9S9", "CopyFileExW", "0f;2u", "GetCPInfo", "RtlFindLeastSignificantBit", "2$2+272<2E2J2P2X2^2f2n2", ".rdata$00$brc", "already connected", "RegCloseKey", "DISABLEDELAYEDEXPANSION", ".didat", "AutoRun", "BELOWNORMAL", "7 7*7;7E7S7]7j7r7", "2;2P2e2x2", " />", "NtFsControlFile" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 1, "cape_type": "", "process_path": "C:\\Windows\\SysWOW64\\cmd.exe", "process_name": "cmd.exe", "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "pid": 1732 }, { "name": "97d270e310b9d835ae345e5abbc0a937242c2164f96f79f5dc6313f2f5deaa83", "path": "/opt/CAPEv2/storage/analyses/5/procdump/97d270e310b9d835ae345e5abbc0a937242c2164f96f79f5dc6313f2f5deaa83", "guest_paths": "1;?C:\\Windows\\SysWOW64\\cmd.exe;?C:\\Windows\\SysWOW64\\cmd.exe;?", "size": 347648, "crc32": "2D58A491", "md5": "bfb38387c171341c3aa585550a8f3209", "sha1": "cf72c5ced931d38c1395d30eaedb4e9017bf0a36", "sha256": "97d270e310b9d835ae345e5abbc0a937242c2164f96f79f5dc6313f2f5deaa83", "sha512": "a8b55db4d1c0800418fad41d9aa12f7e9ac91d02326b99ef6a2992279064af77be2c30ed8454166143aa504df07e56c9413e111e6d2bdb901dc5dcdcb2e6c4f1", "rh_hash": null, "ssdeep": "6144:q2Clk/Le5fYg2d29QPZsy3uZvuvUttSEQmmtrme:q2CsLetYg3A/+JrS9n", "type": "PE32 executable (console) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T116747D21B34890F0CA622174557AF7339C7DBE35875562C7A7E05E6B78A03C2B53C36A", "sha3_384": "ec2903c867e44314b51f2549f930ace5555817e092f49c4a965cfa6d627da4ea2e395617379dbc44a8de57ea3d5b23a4", "yara_hash": "fe117167fbd534878f0d9e7ac29fa46e0f54b9514e7874201773b1e16ed71c1a", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "This file format cannot be verified because it is not recognized.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00b20000", "entrypoint": "0x00016b20", "ep_bytes": "e8d0050000e9d9fdffffcccccccccccc", "peid_signatures": null, "reported_checksum": "0x00046aec", "actual_checksum": "0x0005ae0c", "osversion": "10.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "cmd.pdb", "imports": { "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0xb6a314", "name": "__dllonexit" }, { "address": "0xb6a318", "name": "_unlock" }, { "address": "0xb6a31c", "name": "_lock" }, { "address": "0xb6a320", "name": "_initterm" }, { "address": "0xb6a324", "name": "wcsspn" }, { "address": "0xb6a328", "name": "_tell" }, { "address": "0xb6a32c", "name": "_except_handler4_common" }, { "address": "0xb6a330", "name": "__setusermatherr" }, { "address": "0xb6a334", "name": "__p__fmode" }, { "address": "0xb6a338", "name": "_cexit" }, { "address": "0xb6a33c", "name": "_exit" }, { "address": "0xb6a340", "name": "__set_app_type" }, { "address": "0xb6a344", "name": "__getmainargs" }, { "address": "0xb6a348", "name": "_amsg_exit" }, { "address": "0xb6a34c", "name": "__p__commode" }, { "address": "0xb6a350", "name": "_XcptFilter" }, { "address": "0xb6a354", "name": "calloc" }, { "address": "0xb6a358", "name": "free" }, { "address": "0xb6a35c", "name": "_purecall" }, { "address": "0xb6a360", "name": "__CxxFrameHandler3" }, { "address": "0xb6a364", "name": "?terminate@@YAXXZ" }, { "address": "0xb6a368", "name": "_wcslwr" }, { "address": "0xb6a36c", "name": "_controlfp" }, { "address": "0xb6a370", "name": "_dup2" }, { "address": "0xb6a374", "name": "memcmp" }, { "address": "0xb6a378", "name": "_local_unwind4" }, { "address": "0xb6a37c", "name": "_dup" }, { "address": "0xb6a380", "name": "??1type_info@@UAE@XZ" }, { "address": "0xb6a384", "name": "_close" }, { "address": "0xb6a388", "name": "_open_osfhandle" }, { "address": "0xb6a38c", "name": "swscanf" }, { "address": "0xb6a390", "name": "_ultoa" }, { "address": "0xb6a394", "name": "_pipe" }, { "address": "0xb6a398", "name": "memmove" }, { "address": "0xb6a39c", "name": "wcsncmp" }, { "address": "0xb6a3a0", "name": "_setmode" }, { "address": "0xb6a3a4", "name": "exit" }, { "address": "0xb6a3a8", "name": "_getch" }, { "address": "0xb6a3ac", "name": "iswspace" }, { "address": "0xb6a3b0", "name": "wcschr" }, { "address": "0xb6a3b4", "name": "iswxdigit" }, { "address": "0xb6a3b8", "name": "_setjmp3" }, { "address": "0xb6a3bc", "name": "time" }, { "address": "0xb6a3c0", "name": "srand" }, { "address": "0xb6a3c4", "name": "_wtol" }, { "address": "0xb6a3c8", "name": "fflush" }, { "address": "0xb6a3cc", "name": "wcsstr" }, { "address": "0xb6a3d0", "name": "iswalpha" }, { "address": "0xb6a3d4", "name": "wcstoul" }, { "address": "0xb6a3d8", "name": "??3@YAXPAX@Z" }, { "address": "0xb6a3dc", "name": "_errno" }, { "address": "0xb6a3e0", "name": "??_V@YAXPAX@Z" }, { "address": "0xb6a3e4", "name": "printf" }, { "address": "0xb6a3e8", "name": "memcpy_s" }, { "address": "0xb6a3ec", "name": "_onexit" }, { "address": "0xb6a3f0", "name": "fgets" }, { "address": "0xb6a3f4", "name": "qsort" }, { "address": "0xb6a3f8", "name": "rand" }, { "address": "0xb6a3fc", "name": "_pclose" }, { "address": "0xb6a400", "name": "fprintf" }, { "address": "0xb6a404", "name": "wcsrchr" }, { "address": "0xb6a408", "name": "ferror" }, { "address": "0xb6a40c", "name": "realloc" }, { "address": "0xb6a410", "name": "towlower" }, { "address": "0xb6a414", "name": "setlocale" }, { "address": "0xb6a418", "name": "towupper" }, { "address": "0xb6a41c", "name": "_wcsupr" }, { "address": "0xb6a420", "name": "feof" }, { "address": "0xb6a424", "name": "_wpopen" }, { "address": "0xb6a428", "name": "_wcsnicmp" }, { "address": "0xb6a42c", "name": "_get_osfhandle" }, { "address": "0xb6a430", "name": "longjmp" }, { "address": "0xb6a434", "name": "iswdigit" }, { "address": "0xb6a438", "name": "wcstol" }, { "address": "0xb6a43c", "name": "_vsnwprintf" }, { "address": "0xb6a440", "name": "_wcsicmp" }, { "address": "0xb6a444", "name": "__iob_func" }, { "address": "0xb6a448", "name": "malloc" }, { "address": "0xb6a44c", "name": "_callnewh" }, { "address": "0xb6a450", "name": "??0exception@@QAE@ABQBD@Z" }, { "address": "0xb6a454", "name": "??0exception@@QAE@ABQBDH@Z" }, { "address": "0xb6a458", "name": "??0exception@@QAE@ABV0@@Z" }, { "address": "0xb6a45c", "name": "??1exception@@UAE@XZ" }, { "address": "0xb6a460", "name": "?what@exception@@UBEPBDXZ" }, { "address": "0xb6a464", "name": "_CxxThrowException" }, { "address": "0xb6a468", "name": "memcpy" }, { "address": "0xb6a46c", "name": "memset" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0xb6a474", "name": "NtOpenProcessToken" }, { "address": "0xb6a478", "name": "NtQueryInformationToken" }, { "address": "0xb6a47c", "name": "NtClose" }, { "address": "0xb6a480", "name": "NtOpenThreadToken" }, { "address": "0xb6a484", "name": "NtFsControlFile" }, { "address": "0xb6a488", "name": "RtlDosPathNameToNtPathName_U" }, { "address": "0xb6a48c", "name": "RtlFindLeastSignificantBit" }, { "address": "0xb6a490", "name": "RtlFreeHeap" }, { "address": "0xb6a494", "name": "RtlReleaseRelativeName" }, { "address": "0xb6a498", "name": "NtOpenFile" }, { "address": "0xb6a49c", "name": "RtlDosPathNameToRelativeNtPathName_U_WithStatus" }, { "address": "0xb6a4a0", "name": "NtSetInformationFile" }, { "address": "0xb6a4a4", "name": "NtQueryVolumeInformationFile" }, { "address": "0xb6a4a8", "name": "NtSetInformationProcess" }, { "address": "0xb6a4ac", "name": "NtQueryInformationProcess" }, { "address": "0xb6a4b0", "name": "RtlNtStatusToDosError" }, { "address": "0xb6a4b4", "name": "NtCancelSynchronousIoFile" }, { "address": "0xb6a4b8", "name": "RtlCreateUnicodeStringFromAsciiz" }, { "address": "0xb6a4bc", "name": "RtlFreeUnicodeString" } ] }, "api-ms-win-core-kernel32-legacy-l1-1-0": { "dll": "api-ms-win-core-kernel32-legacy-l1-1-0.dll", "imports": [ { "address": "0xb6a15c", "name": "GetConsoleWindow" }, { "address": "0xb6a160", "name": "CopyFileW" } ] }, "api-ms-win-core-libraryloader-l1-2-0": { "dll": "api-ms-win-core-libraryloader-l1-2-0.dll", "imports": [ { "address": "0xb6a168", "name": "GetProcAddress" }, { "address": "0xb6a16c", "name": "GetModuleFileNameA" }, { "address": "0xb6a170", "name": "LoadLibraryExW" }, { "address": "0xb6a174", "name": "GetModuleHandleW" }, { "address": "0xb6a178", "name": "GetModuleHandleExW" }, { "address": "0xb6a17c", "name": "GetModuleFileNameW" } ] }, "api-ms-win-core-synch-l1-1-0": { "dll": "api-ms-win-core-synch-l1-1-0.dll", "imports": [ { "address": "0xb6a27c", "name": "WaitForSingleObject" }, { "address": "0xb6a280", "name": "TryAcquireSRWLockExclusive" }, { "address": "0xb6a284", "name": "CreateSemaphoreExW" }, { "address": "0xb6a288", "name": "CreateMutexExW" }, { "address": "0xb6a28c", "name": "OpenSemaphoreW" }, { "address": "0xb6a290", "name": "AcquireSRWLockShared" }, { "address": "0xb6a294", "name": "ReleaseSRWLockShared" }, { "address": "0xb6a298", "name": "InitializeCriticalSection" }, { "address": "0xb6a29c", "name": "EnterCriticalSection" }, { "address": "0xb6a2a0", "name": "ReleaseSemaphore" }, { "address": "0xb6a2a4", "name": "ReleaseSRWLockExclusive" }, { "address": "0xb6a2a8", "name": "LeaveCriticalSection" }, { "address": "0xb6a2ac", "name": "ReleaseMutex" }, { "address": "0xb6a2b0", "name": "WaitForSingleObjectEx" } ] }, "api-ms-win-core-heap-l1-1-0": { "dll": "api-ms-win-core-heap-l1-1-0.dll", "imports": [ { "address": "0xb6a128", "name": "HeapAlloc" }, { "address": "0xb6a12c", "name": "HeapSetInformation" }, { "address": "0xb6a130", "name": "HeapReAlloc" }, { "address": "0xb6a134", "name": "GetProcessHeap" }, { "address": "0xb6a138", "name": "HeapSize" }, { "address": "0xb6a13c", "name": "HeapFree" } ] }, "api-ms-win-core-errorhandling-l1-1-0": { "dll": "api-ms-win-core-errorhandling-l1-1-0.dll", "imports": [ { "address": "0xb6a07c", "name": "SetLastError" }, { "address": "0xb6a080", "name": "GetLastError" }, { "address": "0xb6a084", "name": "SetErrorMode" }, { "address": "0xb6a088", "name": "UnhandledExceptionFilter" }, { "address": "0xb6a08c", "name": "SetUnhandledExceptionFilter" } ] }, "api-ms-win-core-processthreads-l1-1-0": { "dll": "api-ms-win-core-processthreads-l1-1-0.dll", "imports": [ { "address": "0xb6a1f0", "name": "GetStartupInfoW" }, { "address": "0xb6a1f4", "name": "GetCurrentThreadId" }, { "address": "0xb6a1f8", "name": "CreateProcessW" }, { "address": "0xb6a1fc", "name": "CreateProcessAsUserW" }, { "address": "0xb6a200", "name": "UpdateProcThreadAttribute" }, { "address": "0xb6a204", "name": "InitializeProcThreadAttributeList" }, { "address": "0xb6a208", "name": "GetExitCodeProcess" }, { "address": "0xb6a20c", "name": "TerminateProcess" }, { "address": "0xb6a210", "name": "GetCurrentProcessId" }, { "address": "0xb6a214", "name": "GetCurrentProcess" }, { "address": "0xb6a218", "name": "DeleteProcThreadAttributeList" }, { "address": "0xb6a21c", "name": "OpenThread" }, { "address": "0xb6a220", "name": "ResumeThread" } ] }, "api-ms-win-core-localization-l1-2-0": { "dll": "api-ms-win-core-localization-l1-2-0.dll", "imports": [ { "address": "0xb6a184", "name": "GetLocaleInfoW" }, { "address": "0xb6a188", "name": "FormatMessageW" }, { "address": "0xb6a18c", "name": "SetThreadLocale" }, { "address": "0xb6a190", "name": "GetACP" }, { "address": "0xb6a194", "name": "GetThreadLocale" }, { "address": "0xb6a198", "name": "GetUserDefaultLCID" }, { "address": "0xb6a19c", "name": "GetCPInfo" } ] }, "api-ms-win-core-debug-l1-1-0": { "dll": "api-ms-win-core-debug-l1-1-0.dll", "imports": [ { "address": "0xb6a05c", "name": "OutputDebugStringW" }, { "address": "0xb6a060", "name": "IsDebuggerPresent" }, { "address": "0xb6a064", "name": "DebugBreak" } ] }, "api-ms-win-core-handle-l1-1-0": { "dll": "api-ms-win-core-handle-l1-1-0.dll", "imports": [ { "address": "0xb6a11c", "name": "CloseHandle" }, { "address": "0xb6a120", "name": "DuplicateHandle" } ] }, "api-ms-win-core-memory-l1-1-0": { "dll": "api-ms-win-core-memory-l1-1-0.dll", "imports": [ { "address": "0xb6a1a4", "name": "VirtualFree" }, { "address": "0xb6a1a8", "name": "VirtualAlloc" }, { "address": "0xb6a1ac", "name": "VirtualQuery" }, { "address": "0xb6a1b0", "name": "ReadProcessMemory" } ] }, "api-ms-win-core-console-l1-1-0": { "dll": "api-ms-win-core-console-l1-1-0.dll", "imports": [ { "address": "0xb6a008", "name": "ReadConsoleW" }, { "address": "0xb6a00c", "name": "WriteConsoleW" }, { "address": "0xb6a010", "name": "GetConsoleMode" }, { "address": "0xb6a014", "name": "SetConsoleMode" }, { "address": "0xb6a018", "name": "SetConsoleCtrlHandler" }, { "address": "0xb6a01c", "name": "GetConsoleOutputCP" } ] }, "api-ms-win-core-file-l1-1-0": { "dll": "api-ms-win-core-file-l1-1-0.dll", "imports": [ { "address": "0xb6a094", "name": "ReadFile" }, { "address": "0xb6a098", "name": "GetFileAttributesW" }, { "address": "0xb6a09c", "name": "GetFileSize" }, { "address": "0xb6a0a0", "name": "SetFilePointer" }, { "address": "0xb6a0a4", "name": "GetFullPathNameW" }, { "address": "0xb6a0a8", "name": "GetVolumePathNameW" }, { "address": "0xb6a0ac", "name": "CreateFileW" }, { "address": "0xb6a0b0", "name": "WriteFile" }, { "address": "0xb6a0b4", "name": "SetFilePointerEx" }, { "address": "0xb6a0b8", "name": "FindFirstFileExW" }, { "address": "0xb6a0bc", "name": "GetDiskFreeSpaceExW" }, { "address": "0xb6a0c0", "name": "FileTimeToLocalFileTime" }, { "address": "0xb6a0c4", "name": "CompareFileTime" }, { "address": "0xb6a0c8", "name": "RemoveDirectoryW" }, { "address": "0xb6a0cc", "name": "FindFirstFileW" }, { "address": "0xb6a0d0", "name": "GetFileType" }, { "address": "0xb6a0d4", "name": "FindNextFileW" }, { "address": "0xb6a0d8", "name": "FindClose" }, { "address": "0xb6a0dc", "name": "GetVolumeInformationW" }, { "address": "0xb6a0e0", "name": "SetFileTime" }, { "address": "0xb6a0e4", "name": "DeleteFileW" }, { "address": "0xb6a0e8", "name": "SetEndOfFile" }, { "address": "0xb6a0ec", "name": "SetFileAttributesW" }, { "address": "0xb6a0f0", "name": "CreateDirectoryW" }, { "address": "0xb6a0f4", "name": "GetDriveTypeW" }, { "address": "0xb6a0f8", "name": "FlushFileBuffers" }, { "address": "0xb6a0fc", "name": "GetFileAttributesExW" } ] }, "api-ms-win-core-string-l1-1-0": { "dll": "api-ms-win-core-string-l1-1-0.dll", "imports": [ { "address": "0xb6a264", "name": "WideCharToMultiByte" }, { "address": "0xb6a268", "name": "MultiByteToWideChar" } ] }, "api-ms-win-core-processenvironment-l1-1-0": { "dll": "api-ms-win-core-processenvironment-l1-1-0.dll", "imports": [ { "address": "0xb6a1b8", "name": "SetEnvironmentStringsW" }, { "address": "0xb6a1bc", "name": "GetStdHandle" }, { "address": "0xb6a1c0", "name": "SetEnvironmentVariableW" }, { "address": "0xb6a1c4", "name": "GetCurrentDirectoryW" }, { "address": "0xb6a1c8", "name": "FreeEnvironmentStringsW" }, { "address": "0xb6a1cc", "name": "ExpandEnvironmentStringsW" }, { "address": "0xb6a1d0", "name": "GetEnvironmentVariableW" }, { "address": "0xb6a1d4", "name": "GetEnvironmentStringsW" }, { "address": "0xb6a1d8", "name": "SetCurrentDirectoryW" }, { "address": "0xb6a1dc", "name": "SearchPathW" }, { "address": "0xb6a1e0", "name": "GetCommandLineW" } ] }, "api-ms-win-core-console-l2-1-0": { "dll": "api-ms-win-core-console-l2-1-0.dll", "imports": [ { "address": "0xb6a024", "name": "SetConsoleTextAttribute" }, { "address": "0xb6a028", "name": "GetConsoleScreenBufferInfo" }, { "address": "0xb6a02c", "name": "FillConsoleOutputAttribute" }, { "address": "0xb6a030", "name": "FlushConsoleInputBuffer" }, { "address": "0xb6a034", "name": "FillConsoleOutputCharacterW" }, { "address": "0xb6a038", "name": "SetConsoleCursorPosition" }, { "address": "0xb6a03c", "name": "ScrollConsoleScreenBufferW" } ] }, "api-ms-win-security-base-l1-1-0": { "dll": "api-ms-win-security-base-l1-1-0.dll", "imports": [ { "address": "0xb6a304", "name": "RevertToSelf" }, { "address": "0xb6a308", "name": "GetSecurityDescriptorOwner" }, { "address": "0xb6a30c", "name": "GetFileSecurityW" } ] }, "api-ms-win-core-sysinfo-l1-1-0": { "dll": "api-ms-win-core-sysinfo-l1-1-0.dll", "imports": [ { "address": "0xb6a2c0", "name": "GetSystemTimeAsFileTime" }, { "address": "0xb6a2c4", "name": "GetSystemTime" }, { "address": "0xb6a2c8", "name": "GetTickCount" }, { "address": "0xb6a2cc", "name": "SetLocalTime" }, { "address": "0xb6a2d0", "name": "GetLocalTime" }, { "address": "0xb6a2d4", "name": "GetVersion" }, { "address": "0xb6a2d8", "name": "GetWindowsDirectoryW" } ] }, "api-ms-win-core-timezone-l1-1-0": { "dll": "api-ms-win-core-timezone-l1-1-0.dll", "imports": [ { "address": "0xb6a2ec", "name": "FileTimeToSystemTime" }, { "address": "0xb6a2f0", "name": "SystemTimeToFileTime" } ] }, "api-ms-win-core-datetime-l1-1-0": { "dll": "api-ms-win-core-datetime-l1-1-0.dll", "imports": [ { "address": "0xb6a050", "name": "GetTimeFormatW" }, { "address": "0xb6a054", "name": "GetDateFormatW" } ] }, "api-ms-win-core-systemtopology-l1-1-0": { "dll": "api-ms-win-core-systemtopology-l1-1-0.dll", "imports": [ { "address": "0xb6a2e0", "name": "GetNumaHighestNodeNumber" }, { "address": "0xb6a2e4", "name": "GetNumaNodeProcessorMaskEx" } ] }, "api-ms-win-core-console-l2-2-0": { "dll": "api-ms-win-core-console-l2-2-0.dll", "imports": [ { "address": "0xb6a044", "name": "SetConsoleTitleW" }, { "address": "0xb6a048", "name": "GetConsoleTitleW" } ] }, "api-ms-win-core-processenvironment-l1-2-0": { "dll": "api-ms-win-core-processenvironment-l1-2-0.dll", "imports": [ { "address": "0xb6a1e8", "name": "NeedCurrentDirectoryForExePathW" } ] }, "api-ms-win-core-registry-l1-1-0": { "dll": "api-ms-win-core-registry-l1-1-0.dll", "imports": [ { "address": "0xb6a240", "name": "RegSetValueExW" }, { "address": "0xb6a244", "name": "RegCreateKeyExW" }, { "address": "0xb6a248", "name": "RegOpenKeyExW" }, { "address": "0xb6a24c", "name": "RegQueryValueExW" }, { "address": "0xb6a250", "name": "RegCloseKey" }, { "address": "0xb6a254", "name": "RegDeleteValueW" }, { "address": "0xb6a258", "name": "RegDeleteKeyExW" }, { "address": "0xb6a25c", "name": "RegEnumKeyExW" } ] }, "api-ms-win-core-file-l2-1-0": { "dll": "api-ms-win-core-file-l2-1-0.dll", "imports": [ { "address": "0xb6a104", "name": "CreateSymbolicLinkW" }, { "address": "0xb6a108", "name": "GetFileInformationByHandleEx" }, { "address": "0xb6a10c", "name": "MoveFileExW" }, { "address": "0xb6a110", "name": "MoveFileWithProgressW" }, { "address": "0xb6a114", "name": "CreateHardLinkW" } ] }, "api-ms-win-core-heap-l2-1-0": { "dll": "api-ms-win-core-heap-l2-1-0.dll", "imports": [ { "address": "0xb6a144", "name": "GlobalFree" }, { "address": "0xb6a148", "name": "GlobalAlloc" }, { "address": "0xb6a14c", "name": "LocalFree" } ] }, "api-ms-win-core-io-l1-1-0": { "dll": "api-ms-win-core-io-l1-1-0.dll", "imports": [ { "address": "0xb6a154", "name": "DeviceIoControl" } ] }, "api-ms-win-core-winrt-l1-1-0": { "dll": "api-ms-win-core-winrt-l1-1-0.dll", "imports": [ { "address": "0xb6a2f8", "name": "RoInitialize" }, { "address": "0xb6a2fc", "name": "RoUninitialize" } ] }, "api-ms-win-core-processtopology-l1-1-0": { "dll": "api-ms-win-core-processtopology-l1-1-0.dll", "imports": [ { "address": "0xb6a228", "name": "GetThreadGroupAffinity" } ] }, "api-ms-win-core-synch-l1-2-0": { "dll": "api-ms-win-core-synch-l1-2-0.dll", "imports": [ { "address": "0xb6a2b8", "name": "Sleep" } ] }, "api-ms-win-core-profile-l1-1-0": { "dll": "api-ms-win-core-profile-l1-1-0.dll", "imports": [ { "address": "0xb6a238", "name": "QueryPerformanceCounter" } ] }, "api-ms-win-core-string-obsolete-l1-1-0": { "dll": "api-ms-win-core-string-obsolete-l1-1-0.dll", "imports": [ { "address": "0xb6a270", "name": "lstrcmpW" }, { "address": "0xb6a274", "name": "lstrcmpiW" } ] }, "api-ms-win-core-processtopology-obsolete-l1-1-0": { "dll": "api-ms-win-core-processtopology-obsolete-l1-1-0.dll", "imports": [ { "address": "0xb6a230", "name": "SetProcessAffinityMask" } ] }, "api-ms-win-core-apiquery-l1-1-0": { "dll": "api-ms-win-core-apiquery-l1-1-0.dll", "imports": [ { "address": "0xb6a000", "name": "ApiSetQueryApiSetPresence" } ] }, "api-ms-win-core-delayload-l1-1-1": { "dll": "api-ms-win-core-delayload-l1-1-1.dll", "imports": [ { "address": "0xb6a074", "name": "ResolveDelayLoadedAPI" } ] }, "api-ms-win-core-delayload-l1-1-0": { "dll": "api-ms-win-core-delayload-l1-1-0.dll", "imports": [ { "address": "0xb6a06c", "name": "DelayLoadFailureHook" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0004a4c8", "size": "0x000002f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0004e000", "size": "0x000084f8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00057000", "size": "0x000025f0" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x000035a0", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000015d0", "size": "0x000000ac" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x0002cd9c", "size": "0x00000080" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x0002d000", "size_of_data": "0x0002c000", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.58" }, { "name": ".data", "raw_address": "0x0002c400", "virtual_address": "0x0002e000", "virtual_size": "0x0001c000", "size_of_data": "0x0001b600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.15" }, { "name": ".idata", "raw_address": "0x00047a00", "virtual_address": "0x0004a000", "virtual_size": "0x00003000", "size_of_data": "0x00002600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.68" }, { "name": ".didat", "raw_address": "0x0004a000", "virtual_address": "0x0004d000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.89" }, { "name": ".rsrc", "raw_address": "0x0004a200", "virtual_address": "0x0004e000", "virtual_size": "0x00009000", "size_of_data": "0x00008600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "4.36" }, { "name": ".reloc", "raw_address": "0x00052800", "virtual_address": "0x00057000", "virtual_size": "0x00003000", "size_of_data": "0x00002600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.80" } ], "overlay": null, "resources": [ { "name": "MUI", "offset": "0x00056420", "size": "0x000000d8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.68" }, { "name": "RT_ICON", "offset": "0x0004e778", "size": "0x00000668", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.65" }, { "name": "RT_ICON", "offset": "0x0004ede0", "size": "0x000002e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.44" }, { "name": "RT_ICON", "offset": "0x0004f0c8", "size": "0x00000128", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.17" }, { "name": "RT_ICON", "offset": "0x0004f1f0", "size": "0x00000ea8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.06" }, { "name": "RT_ICON", "offset": "0x00050098", "size": "0x000008a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.07" }, { "name": "RT_ICON", "offset": "0x00050940", "size": "0x00000568", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.71" }, { "name": "RT_ICON", "offset": "0x00050ea8", "size": "0x0000169e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.85" }, { "name": "RT_ICON", "offset": "0x00052548", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.88" }, { "name": "RT_ICON", "offset": "0x00054af0", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.97" }, { "name": "RT_ICON", "offset": "0x00055b98", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.17" }, { "name": "RT_GROUP_ICON", "offset": "0x00056000", "size": "0x00000092", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.90" }, { "name": "RT_VERSION", "offset": "0x00056098", "size": "0x00000388", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.50" }, { "name": "RT_MANIFEST", "offset": "0x0004e350", "size": "0x00000426", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.00" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Windows Command Processor" }, { "name": "FileVersion", "value": "10.0.19041.746 (WinBuild.160101.0800)" }, { "name": "InternalName", "value": "cmd" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "Cmd.Exe" }, { "name": "ProductName", "value": "Microsoft® Windows® Operating System" }, { "name": "ProductVersion", "value": "10.0.19041.746" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "392b4d61b1d1dadc1f06444df258188a", "timestamp": "2102-04-20 00:53:43", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAACp0lEQVR4nO2ZPW/TQByHH8cpUyWQ2NjKd+AjNK1U1ZGQkBjZYWNhQAIEUmFgKuwsSEhISElV0TeoVFUsnSLUgS6J2nRJA0mTpknss8OQ2thN3Z7Tl5ORH+lyf/sud7+fz3e+OJCQkBBrNIDnL2ceaZo2q1qMDJ1O+/HMqxfvAAvopQE0TZu9e+++MlHvP+QAePgge+bxl8+f3gIfgRpgpq9a7Em4QmWPgetAC78BPZWiUS2f2Vkv+BG5/Hidftav2/PlbvJz89ZtN0wDKTfon0nrzLx+868TXwMnxbLJcZyB2M2FENi2jRACy7K83DRN2u02nU4Hy7I8TT9/lQYuRir0MsUEz8Dx4YoLp45APp8nn8+Hli8sLFy4oKiEGsjlchiGgWEYzM3Neefn5+cD9RYXFy9PnQRSc2B6etqLp6amvHhychKApaWlC5Ylz7kn8cTEBADLy8vnFjMMUgZOu4UAMpkMACsrKxckSx7vOXB8Ecpms94EDruF/IyPjwdGYXV1NbTT0dFRAG/Nd9F1HV3XA88LaQPVWmOg0DCMMxsAME2TWq3G2NgYzWaTRqOBpmlS3/Vj2za2bYeWV37vD5wbei/UbDapVCrs7e1Rr9eHbebcRDIghGBnZ4dSqcTh4eFlaYqElIGDgwOKxSK7u7sIIS5bUyRONSCEYGtri2KxKDWhVOBbhYLLULlcZnNzk263e+WiojAwAo7jUCgU2N7eVqEnMgEDpmmysbFBtVpVpScyngHH6bG2tkar1VKpJzLeVkLYduzEw//0iyyuJAZUkxhQTWJANYkB1cTeQGA3+u1HQZWOoUkD7NfrmfXvX9W9XovAs6dP7gBdQMDRf2TACHDjKI2oEBaBLvAHaAC2a0CjPxrXAF2RMFkEfRPhL5ASEhLiw1+s5V9Z8HnusgAAAABJRU5ErkJggg==", "icon_hash": "00d152c1523e56c619d25f6c96c21a41", "icon_fuzzy": "e55641fba39eaff4ee89e5fc0af8f337", "icon_dhash": "a2ae7a370101a3c0", "imported_dll_count": 37 }, "data": null, "strings": [ "SetThreadLocale", "2]3i3{3", "=q?{?", "WNetGetConnectionWStub", "OutputDebugStringW", ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC", "3/363G3", "9n9z9", "2$2_2e2l2", "RWRVh", "v", ")030`0", "%hs(%d) tid(%x) %08X %ws", "host_unreachable", "__p__commode", "UnhandledExceptionFilter", "yy/MM/dd", "5;5B5j5", "RtlCreateUnicodeStringFromAsciiz", "4I4X4", "api-ms-win-core-heap-l1-1-0.dll", "address in use", "no_buffer_space", "cross device link", "?what@exception@@UBEPBDXZ", "connection_aborted", "no stream resources", "<1<6", "CMDEXTVERSION", "uBSWR", "QShc#", "VS_VERSION_INFO", "80J0f0u0", "t$ WWWV", "D$xPh", "%2d%s%02d%s%02d%s%02d", "t$0j ", "WGeToken: (%x) '%s'", "FindFirstFileExW", ">x?}?", "_exit", "4'5A5", "YYf9}", "LeaveCriticalSection", "%02d%s%02d%s", "ASSOC", "en-US", "timed_out", "api-ms-win-core-file-l1-1-0.dll", "onecore\\base\\cmd\\StartShellExecServiceProvider.h", "j.Yf;", "GetTickCount", "RtlNtStatusToDosError", ":%:,:::C:z:", ";$;-;5;T;Z;", "1B1N1i1t1", "BrandingFormatString", ".?AVout_of_range@std@@", "u&QWS", "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", "GlobalAlloc", "%s %s ", "SVWt j", " /D /c\"", ">9?R?d?", ".data$pr00", "L$(t:", "VirtualAlloc", " %x %c", " /K %s", "GetTimeFormatW", "COLOR", ">&?.?D?L?i?s?", "CreateMutexExW", "SetConsoleTextAttribute", "j\\^f9q", "DebugBreak", "no such device or address", " &()[]{}^=;!%'+,`~", "<\"<'<7<", "connection aborted", "848B8b8g8", "D$(PV", ":=:C:M:S:\\:a:", "0123456789", " ", "argument list too long", ".gljmp", "C0K0Q0W0j0{0", "ReadProcessMemory", "NtQueryInformationProcess", "not connected", "_vsnwprintf", "wcschr", "REM /?", "<%", "MessageBeepStub", "iostream", "@$9Q w", "7.9\\9", "91:;:L:`:j:{:", "ProductName", "1,1q1!2'2]2", "D$LPV", "6.6A6I6m6s6y6", "v(h(4", "VPSRW", "api-ms-win-core-synch-l1-1-0.dll", "NtSetInformationProcess", "t%j\\Xf;", "message_size", "host unreachable", "6h7l7p7t7x7", "", "9/:z:", "2Q2W2]2c2h2n2", "1#101O1\\1x1", "b$j-0", "QSVWj", " name=\"Microsoft.Windows.FileSystem.CMD\"", ":#:(:8:n:{:", "<;O>\\>", ";';9;I;O;q;", ";4;L;`;d;x;|;", "f;D$,u", "EXIST", "D$,SVW", "D$hP3", "_XcptFilter", "797Y7", "3C3O3m3", "x]j:Xf", "GetLocaleInfoW", "ntdll.dll", "????????.???", "6&616f6{6", "Yj f;", "is a directory", "WNetCancelConnection2WStub", ">(>P>f>s>", "<>+-*/%()|^&=,", "3(343@3L3", "D$xPj", "_wpopen", "skip=", "operation canceled", "0=0Q0W0", "323<3", ".?AVbad_alloc@std@@", "NDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD", "041=1O1X1", "1e1j1", "<5<=", "_amsg_exit", "api-ms-win-security-base-l1-1-0.dll", " v,PW", "Se%ae`", "=,;+/[] ", "rmdir ", "t+Vh5#", "@PVVWSQ", "=0I0N0j0q0", "=\"=F=J=N=R=V=Z=^=b=f=j=", "7 848v8{8Q9v9", "__set_app_type", "SetFileAttributesW", "Redir: ", ">i?y?", "HIGHESTNUMANODENUMBER", ">3>P>b>", "invalid argument", "GetProcessHeap", "j\"Zf;", "", "GetNumaHighestNodeNumber", "api-ms-win-core-string-obsolete-l1-1-0.dll", "ho User: %USERNAME%", ":X:l:", ".CRT$XCU", "FindClose", ".rsrc", "RegDeleteValueW", "*** Unknown type: %x", "FillConsoleOutputCharacterW", "j\\Yf;", "Cmd: %s Type: %x ", "GetDateFormatW", ".text", "tbhX ", "SetEndOfFile", "VarFileInfo", "t5PPQh", "realloc", "=W>]>", "t*h0$", " \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"", "j\"ZRV", "RRRRP%", "?Q?V?m?", "405h5", "PathCompletionChar", "address_not_available", ">*>t>{>", "D$`PV", "too many files open", "D$&PVj", "4N4m4}4", "=9=@=U=\\=l=v=", "FlushFileBuffers", "operation would block", "__iob_func", "696^6", "cmd.pdb", ".idata$4", "?*?E?K?", "T$$;T$", "GetWindowsDirectoryW", "1'141>1L1a1", "GetDiskFreeSpaceExW", "D$hPQj", " ", "L$8Q3", "DeleteFileW", "t$Sh4&", "3)4P4`4", ";2Windows Command Processor", "FileTimeToLocalFileTime", "7D7U7[7a7|7", "u\"j:Xf9F", "j\\Xf9", "owner dead", "SetConsoleCursorPosition", "2 2&2-222=2m2s2", "no such process", "D3blc", "GetConsoleOutputCP", "; ;&;+;1;7;K;V;[;a;g;", "iH4-N", ".data$brc", "FailFast", "9t$$~n", "9):B:Q:", "BREAK", "8.8X8", ".text$di", "START", "1$1,141<1D1L1T1\\1d1l1t1|1", "bad file descriptor", "6!6'6-636=6L6R6Z6y6~6", "5G5U5b5", "0/0A0", "ENABLEEXTENSIONS", ">+>>>B>F>J>N>R>V>Z>^>b>u>", "9L:~;", "@PVVWS", "api-ms-win-core-synch-l1-2-0.dll", ">Q>_>t>{>", ".didat$4", ".text$yd", "filename too long", "CMDCMDLINE", "\\Shell\\Open\\Command", ";O;^;v;};", ".CRT$XIY", "DefaultColor", "j\\^f91", "GlobalFree", "directory not empty", "network_reset", "swscanf", "4h4t4", "8<8K8", ":):R:", "6,7E7M7", "Copyright (c) Microsoft Corporation. All rights reserved.", "interrupted", ":$:-:", "resource deadlock would occur", "j:Zf;", "3H4`4o4", "RegOpenKeyExW", "VShb#", "Software\\Classes", "api-ms-win-core-libraryloader-l1-2-0.dll", "D$ Ph", "j Xf9DN", "VPj#S", "91:K:\\:", "MKLINK", " version=\"5.1.0.0\"", "PATHEXT", "WNetAddConnection2WStub", "YY8\\$", "cCBR_p", "7c7u7", "3c4p4", ".didat$6", "GetFullPathNameW", "j\\Yf9", "tDSSSS", "F>^>s>", "NTDLL.DLL", "_except_handler4_common", "4)4G4", "timed out", ":.;^;", ")>4>H>", "8B9_9z9", "j.Xf9", "7)7x7", "5>5R5", "6?6I6Y6e6", "RemoveDirectoryW", "<3=i=v=", "FreeEnvironmentStringsW", "='=5=C=T=\\=r=z=", "=.=?=L=Z=r={=", "_setjmp3", "=L>h>", "(%s) %s ", "bad message", "<$;X;", "j\"Yf;", " true", "fflush", "api-ms-win-core-delayload-l1-1-0.dll", "not supported", "8#828A8F8Z8i8", "0$0,040<0D0L0T0X0\\0`0d0h0l0p0t0x0|0", "WWWSQ", "connection refused", "7H8e8", "3D3X3l3", "lext-ms-win-cmd-util-l1-1-0", "wrong_protocol_type", "NtQueryInformationToken", "C:\\Users\\malware\\AppData\\Local\\Temp", "inappropriate io control operation", "VVVVR", "DEFINED", "\\XCOPY.EXE", "j-[f;", "GetLocalTime", "131w1W3]3z3", "network reset", "[%hs(%hs)]", "Application", "__setusermatherr", "APerformArithmeticOperation: '%c'", "63696F6T6k6", "GetFileSecurityW", "5&5a5", "connection reset", "api-ms-win-core-kernel32-legacy-l1-1-0.dll", "connection_refused", "6!7k7", "<,<4C>Z>o>", "1D2d2z2", "D$(PQ", "WriteFile", "GetVDMCurrentDirectoriesStub", "not_connected", "D$D;D$,", ":S:`:", "delims=", "2!2'2W2w2", "j=Xf9", "operation_not_supported", "j:Yf9H", "ShellExecuteExW", "PAUSE", ".data", "SetFilePointer", "=)>A>", ".giats", "'ao@'ao", "GetEnvironmentVariableW", "address family not supported", ";2;I;R;];d;v;|;", "CompletionChar", "010@0N0U0", "iWWSQ", "7&7-7=7S7Z7f7}7", "T$tRP", ".bss$zz", "IF /?", ">:>h>", "NtOpenProcessToken", "too_many_files_open", "WSh!'", "Exception", "3!3)3;3A3", "t$true", "connection already in progress", "4'40474>4Y4c4l4v4", "9T:Z:", ".data$00", "L$XQ3", "_initterm", "829Q9^:", "4W5d5s5", "NtOpenFile", "0!1q1", "EnterCriticalSection", "Msg:[%ws] ", "f;D$d", "!This program cannot be run in DOS mode.", "GetVersion", "", "WilError_03", "pqacG%%apppppppaB", ".text$mn", "f;D$$u", "ext-ms-win-branding-winbrand-l1-2-0", "ReleaseSRWLockExclusive", "no message", "4$4.464B4J4X4`4", "NtClose", "`j/Yf;", "GetProcAddress", "314V4n4", "already_connected", "u3SSh,<", "NQ>", "7!8,8L8q8{8", "3_3s3", "1#1*1", "9U:r:", "6)60676V6}6", "tef93t`", "6 6W6", "VERIFY", "SVWj/X", "api-ms-win-core-winrt-l1-1-0.dll", "FindNextStreamWStub", "address not available", "MultiByteToWideChar", "j:Xf9", "7I7h7", "5?6X6", "DIRCMD", "1$131<1E1Z1o1~1", "FormatMessageW", "NEWWINDOW", "*tr;]", "tEht&", "[%hs]", "j:Xf9F", "api-ms-win-core-processenvironment-l1-1-0.dll", "@Qm6t", "MM/dd/yy", "0>0r0", "(caller: %p) ", "not a directory", "HeapReAlloc", "ReleaseMutex", "9!9<9s9", "HeapAlloc", "??0exception@@QAE@ABQBD@Z", "6@6`6", "cG?CCRRRRP`R", "onecore\\base\\cmd\\maxpathawarestring.cpp", "wcsspn", " [...]", "0X1]1q1", "969E9", "4Y4,5b5E6", "D$$9L$", "QQh|4", ": :.:G:M:S:Z:`:k:r:", "protocol error", "text file busy", "{~WPh", "lstrcmpiW", "2%232C2N2e2z2", "SetLastError", "6\"6(6,6?6D6U6s6y6", "ext-ms-win-shell-shell32-l1-2-0", "<$=,=<=R=Z=j=~=", " type=\"win32\"", "ext-ms-win-cmd-util-l1-1-0.dll", "connection_reset", "<0W0b0f0r0v0", "no link", ".gfids", "3%4}4", "5G5i5", "QQSVW", "u)Rh7#", "VQh(=", "8::@:T:Z:`:j:t:{:", "4R5]5c5", "t$1N1p1u1", "fprintf", "Software\\Microsoft\\Windows NT\\CurrentVersion", "j$Xf;", "HeapSetInformation", "GetThreadLocale", "j/Xf;", ".text$zz", "GetCurrentProcessId", "9Q9y9", "GetModuleFileNameW", "7(7,7@7D7X7\\7p7t7", "wwwwwwwwwwwwwww", "0(0=0K0T0c0h0m0", "cal\\Temp\\test_win.bat", "8\"8*82878>8F8U8a8l8", "CMD.EXE", "60676C6Y6a6h6{6", "yuPA{u", "api-ms-win-core-sysinfo-l1-1-0.dll", "4`5d5h5l5p5t5", "798P8q8", "j\"Yf9", "5u6~6", "|$B:tQ", "api-ms-win-core-heap-l2-1-0.dll", "L$xQQ3", "0A0\\0e0k0p0y0", "value too large", "5@6^657T7r7", "D$PSV", "resource unavailable try again", "PU,//", "LoadLibraryExW", "%s %s%s ", "j\\Xf;", "Vj ^S", "_pipe", "iswxdigit", ";Q;p;x;", ";';-;V;g;m;", "6'6\\6", "iswalpha", "ResumeThread", "CopyFileW", "8(8/8G8h8t8z8", "?Rich", "ABOVENORMAL", "NtOpenThreadToken", "9\"949F9M9U9[9n9u9", "operation_would_block", "wcstol", "function not supported", "3-3;3I3", "0_0h0", "PWhl;", "778I8", "4sf9>", "\\$0SP", "X1>>>V>l>", ";b+?9?~?", ";0<7<", "unknown error", "CallContext:[%hs] ", "network_unreachable", "no buffer space", "5(5<5V5]5~5", "?\"?d?p?x?", "SetCurrentDirectoryW", "?=?h?o?z?", "protocol not supported", "929O9U9f9{9F:", "ReleaseSemaphore", ".data$zz", "SetConsoleMode", " [..]", ".text$zs", "DeleteProcThreadAttributeList", "PROMPT", "t$pVQ", "2#3l3", "|$$f9", "FOR /?", "%d.%d.%05d.%d", "DPATH", ".data$r$brc", "WShD#", "Microsoft", "1W1^1", "t5j Y", "9 979F9", "L$,RQh", "qsort", "t\"j*Z", "PSh[#", ".rsrc$02", "tBj0Y", "8\"8'8<8H8O8Z8a8l8s8~8", "OriginalFilename", ":f;w;", "AcquireSRWLockShared", "848<8s8", "_ultoa", "SETLOCAL", "<<=F=Y=c=", "SWhl;", "too many links", "#D$Lt", "GetConsoleWindow", "RegSetValueExW", "0+1b1", "j-Zj/Yf;", "file exists", "invalid_argument", "ENABLEDELAYEDEXPANSION", "SetProcessAffinityMask", "=ExitCodeAscii", "j\\Zj:Yf", "6T6r6", ".EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", "uCj\\Z", "CompanyName", "RWhl;", "_cexit", "api-ms-win-core-processthreads-l1-1-0.dll", "1>2Z2v2", "63696H6M6U6p6", "DelayedExpansion", "7]8i8v8", "eIDATx", "2>X>e>t>", "979V9]9r9y9", "0<1R1g1v1|1", "<$<8<<<@8R8X8^8p8", ".?AVexception@@", "ext-ms-win-shell-shell32-l1-2-1", "FindFirstFileW", "ctff;", "NtSetInformationFile", "959U9", "GetLastError", "RegCreateKeyExW", "permission denied", "171p1", "2<3E3J3Z3k3t3}3", "ShellExecuteWorker", "GetVolumeInformationW", "CloseHandle", "_callnewh", "not enough memory", ".text$zy", "memcpy", "VVVQV", "575>5F5N5", ".rdata$zz", "mkdir ", ".didat$5", "=;=_=", "GetSecurityDescriptorOwner", "iostream stream error", "??1type_info@@UAE@XZ", "708[8", "9~(s+j", "%04X-%04X", ".text$x", "3*3/3y3", "GetExitCodeProcess", "useback", "StringFileInfo", "t3VSh", "L$\\_^[3", "9 969;9C9e9", "too many symbolic link levels", "RtlFreeUnicodeString", "L$8RQRP", "DuplicateHandle", "?Y?s?", "D$pPS", "Translation", "3G4N4", "api-ms-win-core-debug-l1-1-0.dll", "3*353B3P3Z3d3n3x3", "8\"8<8h8", ".bss$00", "vHYY3", "465Y5s5", "72898E8P8e8", "HH:mm:ss t", "fgets", "D$4Pj", "operation not permitted", "_wcslwr", "operation in progress", ".xdata$x", "", "0 0$0(0,0004080@0", "j=XPV", "no protocol option", "SVWQQj", "api-ms-win-core-datetime-l1-1-0.dll", "w>", "f91t.", "4m4~4", "O8j*Z", "srand", "operation not supported", "%WINDOWS_COPYRIGHT%", "HeapFree", " ", "?!?'?-?A?O?e?", "!>D>L>", "RENAME", "api-ms-win-core-processtopology-obsolete-l1-1-0.dll", "8S8Y8", "GetModuleFileNameA", "GetFileAttributesExW", "*)))))))))))))))))))))", "memcmp", "0 0B0b0", "se%%%%% R", "D$8f90", "0,090", "j%Yf;", "GetStartupInfoW", "<1<:=I=N=", "VSh\\#", "21262>2", "D$`;D$d", "5.5=5J5V5", ";8;m;w;", ";>", "vDhd:", "COMSPEC", "ferror", ";D;H;d;h;x;", "SetThreadUILanguage", "98:4;;;", "=A=W=^=g=", "SetConsoleTitleW", "api-ms-win-core-file-l2-1-0.dll", "4qaCCRCCCB", "memset", "5?5g5n5", "9 9$989<9P9T9h9l9", "D$$Ph", "malloc", "939A9H9{9", ";);B;^;", "REM/?", "ENDLOCAL", "6H7R7f7v7}7", "iswspace", "GetFileType", "0Ph4:", "no such device", " ", "='>9>D>R>_>", "D$|QP", "WaitForSingleObject", ".CRT$XCAA", "SetConsoleInputExeNameW", ">1?9?", "4<4l4t4z4", "message size", "api-ms-win-core-memory-l1-1-0.dll", "u%6RRRRRPp", ":$;4;", "memcpy_s", "t;f9;t6", "j%Xf9", "InitializeProcThreadAttributeList", "j Yf9", ":2;_;", "RShl;", "api-ms-win-core-localization-l1-2-0.dll", " uiAccess=\"false\"", "wwwwwwwwwwwwwwwwwwwww", "%hs!%p: ", ";\\$(r", "destination_address_required", "0\"1R1", "0B0i1", "CreateProcessAsUserW", "tJSh$$", "L$ h(#", "PSh^#", ".rdata$zz$brc", "7Y7k7v7", " Operating System", "lware", "FindFirstStreamWStub", "GetFileAttributesW", "GetEnvironmentStringsW", "uqj?Z", "1.13191E1J1P1i1", "5%6+616K6U6a6l6~6", "bad allocation", ".00cfg", ";/;c;", "towlower", "\\CMD.EXE", "j\\Zf9", "_close", "O", "MoveFileExW", "api-ms-win-core-console-l1-1-0.dll", "broken pipe", "no_protocol_option", "VPh]#", "SystemTimeToFileTime", "4r6}6", "474=4G4L4R4`4m4{4", "Wj:Xf9F", "D$H9D$D", "j\\Zj:^f9p", "8<8b8l8q8", "_setmode", "313D3", "D$ PV", "CreateDirectoryW", "api-ms-win-core-timezone-l1-1-0.dll", "wcsrchr", "6%6<6P6g6q6|6", "Sleep", "SetUnhandledExceptionFilter", "'j:Xj.f", "VPh@:", "", "QueryFullProcessImageNameWStub", "__CxxFrameHandler3", "LookupAccountSidWStub", "3*313Z3w3", "939S9d9~9", "2V2]2", "_ _^[", "FileVersion", "j\\Xf9B", "D$dPS", "@_^[]", "config", "t$TShT#", "CreateSemaphoreExW", " 3>C>X?u?", "p>", "SSSSP", "2(2/2H2W2]2m2", "QRRRP", "FindNextFileW", "=-=c=", ":2:C:q:", "", "757S7j7", "Y__^[", ":&:X:", "5Y5z5", "E$uwM", "=ExitCode", "not a stream", "7E7J7`7", "2/2f2o2y2", "D$495", "file too large", "GetThreadGroupAffinity", "_getch", "Software\\Microsoft\\Command Processor", "SetFilePointerEx", "NeedCurrentDirectoryForExePathW", "XXX8Pvh8v", ".idata$2", "api-ms-win-core-io-l1-1-0.dll", "RMDIR", ".?AVlogic_error@std@@", "ExpandEnvironmentStringsW", "7E8O8", "executable format error", "L$xQ3", "7 73787@7\\7", "HeapSize", "SetEnvironmentVariableW", "FileTimeToSystemTime", "3$3,343<3D3L3T3\\3d3l3t3|3", "cmd.exe", "u4h4'", "2$2,242<2D2L2T2\\2d2l2t2|2", "ERASE", "wcsncmp", "string too long", " ", "VirtualFree", "api-ms-win-core-errorhandling-l1-1-0.dll", "RegDeleteKeyExW", " enough memory resources are available to process this command.", ".didat$2", "system", "GetNumaNodeProcessorMaskEx", "io error", "GetConsoleTitleW", ": ;&;W;};", "L$ PSV", "api-ms-win-core-processenvironment-l1-2-0.dll", "m;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32\\Scripts\\;C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32\\;C:\\Users\\malware\\AppData\\Local\\Microsoft\\WindowsApps", "?$?+???I?{?", "1G1^1", "not a socket", "090C0", "ext-ms-win-shell-shell32-l1-2-0.dll", "SetLocalTime", "FOR/?", "090?0H0T0", "%s=%s", "304g4", "DoSHChangeNotify", "KERNEL32.DLL", "979C9S9l9", ".idata", "ApiSetQueryApiSetPresence", "000H0h0", "result out of range", "9 9B9M9_9g9l9q9", "RtlReleaseRelativeName", "CHDIR", "0*1Q1", "T$$9T$", "CmdBatNotificationStub", "FlushConsoleInputBuffer", "SetEnvironmentStringsW", "RtlDisownModuleHeapAllocation", ".idata$3", ".text$np", "not_a_socket", "tokens=", "SEPARATE", "PPWWWQ", "generic", "wrong protocol type", ":(:D:H:d:h:", "argument out of domain", "VirtualQuery", "0B0\\0", "()|&=,;\"", "SaferWorker", "5\"5'5.565F5", ": %USERNAME%", "no message available", "api-ms-win-core-profile-l1-1-0.dll", "9s:z:", "NtCancelSynchronousIoFile", "RoUninitialize", "SVWj,", "%s (%s) %s", "4C4H4", "445(6B6k6r6", "%hs(%u)\\%hs!%p: ", "connection_already_in_progress", "longjmp", "PUSHD", "_wtol", "*?H?N?i?n?s?", ".idata$5", "WaitForSingleObjectEx", "7\"7D7K7Q7f7k7s7", "8'8.8H8", "chdir ", "no space on device", "RaiseFailFastException", "6,7B7I7g7n7", "j\"[umf9", "8#9(9U9p9|9", "Cmd.Exe", "SHIFT", "f;D$8u", "__p__fmode", "dd/MM/yy", "_^[]", "GetCurrentProcess", "GetDriveTypeW", "/w(t`", ">8>E>", ".CRT$XIA", "x4j/Z", "InternalName", "Software\\Policies\\Microsoft\\Windows\\System", "api-ms-win-core-console-l2-2-0.dll", "9E9S9", "CopyFileExW", "0f;2u", "GetCPInfo", "RtlFindLeastSignificantBit", "2$2+272<2E2J2P2X2^2f2n2", ".rdata$00$brc", "already connected", "RegCloseKey", "DISABLEDELAYEDEXPANSION", ".didat", "AutoRun", "BELOWNORMAL", "7 7*7;7E7S7]7j7r7", "2;2P2e2x2", " />", "NtFsControlFile" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 1, "cape_type": "", "process_path": "C:\\Windows\\SysWOW64\\cmd.exe", "process_name": "cmd.exe", "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "pid": 3040 } ], "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-03-12 02:59:55", "ended": "2026-03-12 03:01:55", "duration": 120, "id": 5, "category": "file", "custom": "", "machine": { "id": 5, "status": "stopping", "name": "win10", "label": "win10", "platform": "windows", "manager": "KVM", "started_on": "2026-03-12 02:59:55", "shutdown_on": "2026-03-12 03:01:54" }, "package": "", "timeout": true, "tlp": null, "parent_sample": null, "options": {}, "source_url": null, "route": "", "user_id": 0, "CAPE_current_commit": "0e35d168c0209bbbce54132708d6139b1e04e531" }, "behavior": { "processes": [ { "process_id": 1732, "process_name": "cmd.exe", "parent_id": 5060, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "first_seen": "2026-03-12 10:00:43,333", "calls": [ { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "3796", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "3796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4104", "caller": "0x77931bae", "parentcaller": "0x7792db51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000007c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 3, "id": 2 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4316", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf6\\x1b\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xf6\\x1b\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4104", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00 \\xf0\\x0b\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff(\\xf0\\x0b\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4104", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4104", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4316", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-03-12 10:00:43,630", "thread_id": "4316", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "4232", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00\\xf8\\xee\\xfb\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x00\\xef\\xfb\\x05\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "4232", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "4232", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "1160", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x008\\xef\\x9e\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff@\\xef\\x9e\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "1160", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 13 }, { "timestamp": "2026-03-12 10:00:43,661", "thread_id": "1160", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b309de", "parentcaller": "0x00b36a0a", "category": "threading", "api": "NtOpenThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x001fffff", "pretty_value": "THREAD_ALL_ACCESS" }, { "name": "ProcessId", "value": "1732" }, { "name": "ThreadId", "value": "18446744073603448831" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e2df", "parentcaller": "0x00b36a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e2ff", "parentcaller": "0x00b36a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SetThreadUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x757b6120" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e2c8", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00T\\xf6\\xaf\\x00 \\xf7\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xf7\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xf8\\xaf\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00\nj\\xb3\\x00\\xa8\\xf8\\xaf\\x006\\xe1do\\xa0\t\\x84o\\x8c\\xac\\x8co\\xfc\\x91\\xe2\\x04x\\xaa\\x86o\\xf8\\xf8\\xaf\\x00@\\xfa\\xaf\\x00h\\xf8\\xaf\\x00\\xf8+\\xb9\\x02" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000228" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-2908140568-387960825-2559473725-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000228" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\System" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b31f20", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x98\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00(%\\xb2\\x00\\xa0\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b28836", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00@\\xf8\\xaf\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff(\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2884a", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00@\\xf8\\xaf\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff(\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e328", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00@\\xf8\\xaf\\x00\\x18\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e33f", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-03-12 10:00:43,677", "thread_id": "3796", "caller": "0x00b2e3d7", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2e36e", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2e3a0", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 32 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28319", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "DisableUNCCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28353", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "EnableExtensions" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b283a3", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "DelayedExpansion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b283dd", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "DefaultColor" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2842d", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "CompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2849e", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "PathCompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2852c", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "AutoRun" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28540", "parentcaller": "0x00b2886a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 42 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000228" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2855a", "parentcaller": "0x00b2886a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 44 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28561", "parentcaller": "0x00b2886a", "category": "misc", "api": "srand", "status": true, "return": "0x00000000", "arguments": [ { "name": "seed", "value": "0x69b28ecb" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048e3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07180000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07180000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07191000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071a1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28d99", "parentcaller": "0x00b301ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6a58", "arguments": [ { "name": "FileName", "value": "C:\\Users" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6c58", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6858", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6cd8", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6a58", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28de6", "parentcaller": "0x00b301ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2aa00", "parentcaller": "0x00b301ce", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02bb8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b2dcee", "parentcaller": "0x00b28922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02bb9000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b289b1", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14{\\x96w(\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xd8j\\x01\\x010\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd2O\\x0b\\x00\\x00\\x00\\x00\\x00V\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00R\\xe7\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-03-12 10:00:43,692", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\x8c\\xb9\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-03-12 10:00:43,708", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "3796" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x76d1413c" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 75 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07191000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07191000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000220" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02b80000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02b80000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b289ef", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf8\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x95o\\x9dv\\xb8\\xf8\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x10\\x00\\x00\\x008S\\xbb\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28ac6", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28ad7", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "CopyFileExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75799730" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28aed", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "IsDebuggerPresent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x757a2770" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28afe", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SetConsoleInputExeNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76d9d1e0" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28b1e", "parentcaller": "0x00b30a55", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07194000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28b1e", "parentcaller": "0x00b30a55", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048e3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b2e4f6", "parentcaller": "0x00b30b09", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "start" }, { "name": "Arguments", "value": " /wait \"\" \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000088" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x16\\x00\\x01\\x01H\\xf4\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xa7\\x00\\x00\\x00P\\xf4\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x9c\\x00\\x00\\x00(\\xf7\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07194000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071b1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048e3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048e8000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071c1000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071c6000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071cb000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b2dcee", "parentcaller": "0x00b35d88", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02bbe000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b31d40", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b31d4a", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 101 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x02ba6c58", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FirstCreateTimeLow", "value": "0xc735815f" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb202" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b28b81", "parentcaller": "0x00b2f9d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b2fb05", "parentcaller": "0x00b35d88", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x071c8000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b2fb05", "parentcaller": "0x00b35d88", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048ec000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-03-12 10:00:43,739", "thread_id": "3796", "caller": "0x00b35f10", "parentcaller": "0x00b35a80", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000021c" }, { "name": "ThreadHandle", "value": "0x00000220" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\cmd.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "3040" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-03-12 10:00:43,849", "thread_id": "3796", "caller": "0x00b35f10", "parentcaller": "0x00b35a80", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x778e0000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-03-12 10:00:43,864", "thread_id": "3796", "caller": "0x00b35f10", "parentcaller": "0x00b35a80", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "3796" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x76d1416c" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-03-12 10:00:43,864", "thread_id": "3796", "caller": "0x00b35f10", "parentcaller": "0x00b35a80", "category": "process", "api": "CreateProcessW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\cmd.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"" }, { "name": "CreationFlags", "value": "0x00080410" }, { "name": "ProcessId", "value": "3040" }, { "name": "ThreadId", "value": "4800" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000021c" }, { "name": "ThreadHandle", "value": "0x00000220" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-03-12 10:00:43,864", "thread_id": "3796", "caller": "0x00b35f7f", "parentcaller": "0x00b35a80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-03-12 10:00:43,864", "thread_id": "3796", "caller": "0x00b28209", "parentcaller": "0x00b41e7b", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-03-12 10:01:43,302", "thread_id": "272", "caller": "0x7794b596", "parentcaller": "0x779160ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "272" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-03-12 10:01:43,302", "thread_id": "272", "caller": "0x7794b5b9", "parentcaller": "0x779160ac", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-03-12 10:01:43,302", "thread_id": "2264", "caller": "0x7794b596", "parentcaller": "0x779160ac", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2264" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-03-12 10:01:43,302", "thread_id": "2264", "caller": "0x7794b5b9", "parentcaller": "0x779160ac", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 115 } ], "threads": [ "3796", "4104", "4316", "4232", "1160", "272", "2264" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b20000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 3040, "process_name": "cmd.exe", "parent_id": 1732, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "first_seen": "2026-03-12 10:00:44,067", "calls": [ { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "3740", "caller": "0x77931bae", "parentcaller": "0x7792db51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000080" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 3, "id": 2 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4788", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xf4\\\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xf4\\\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4788", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4788", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "3740", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00X\\xf5L\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff`\\xf5L\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "3740", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "3740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "5984", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00(\\xf5<\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff0\\xf5<\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "5984", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "5984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "6108", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00(\\xf0\\xe1\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff0\\xf0\\xe1\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "6108", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 13 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "6108", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b309de", "parentcaller": "0x00b36a0a", "category": "threading", "api": "NtOpenThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x001fffff", "pretty_value": "THREAD_ALL_ACCESS" }, { "name": "ProcessId", "value": "3040" }, { "name": "ThreadId", "value": "18446744073632808959" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e2df", "parentcaller": "0x00b36a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e2ff", "parentcaller": "0x00b36a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SetThreadUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x757b6120" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14\\xf8\\xd9\\x02\\xe0\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b36a0a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00\nj\\xb3\\x00h\\xfa\\xd9\\x026\\xe1do\\xa0\t\\x84o\\x8c\\xac\\x8col\\x92\"\\x05x\\xaa\\x86o\\xb8\\xfa\\xd9\\x02\\x00\\xfc\\xd9\\x02(\\xfa\\xd9\\x02p,)\\x03" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-2908140568-387960825-2559473725-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b30a10", "parentcaller": "0x00b36a0a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000234" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\System" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b31f20", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00@\\x00\\x00\\x00X\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00(%\\xb2\\x00`\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28836", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\xfa\\xd9\\x02\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xe8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2884a", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\xfa\\xd9\\x02\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xe8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\xfa\\xd9\\x02\\xd8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xd8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e3d7", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xd8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e3a0", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2aa00", "parentcaller": "0x00b30a55", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2aa00", "parentcaller": "0x00b30a55", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 35 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000124" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28319", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "DisableUNCCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28353", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "EnableExtensions" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b283a3", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "DelayedExpansion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b283dd", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "DefaultColor" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2842d", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "CompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2849e", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "PathCompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2852c", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "AutoRun" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28540", "parentcaller": "0x00b2886a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 45 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b282d9", "parentcaller": "0x00b2886a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000234" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2855a", "parentcaller": "0x00b2886a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 47 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28561", "parentcaller": "0x00b2886a", "category": "misc", "api": "srand", "status": true, "return": "0x00000000", "arguments": [ { "name": "seed", "value": "0x69b28ecc" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04d13000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06830000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06830000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06841000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06851000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28d99", "parentcaller": "0x00b301ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6d88", "arguments": [ { "name": "FileName", "value": "C:\\Users" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6d88", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a68c8", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a69c8", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3029d", "parentcaller": "0x00b28dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6d48", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0x3bb960d9" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb1e9" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b302b6", "parentcaller": "0x00b28dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28de6", "parentcaller": "0x00b301ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b28922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b5000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b28922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032ba000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b28922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032bf000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b289b1", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14{\\x96w\\xe8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xd0m\\x01\\x01\\xf0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "|_\\x0b\\x00\\x00\\x00\\x00\\x00V\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00R\\xe7\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xa0*\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "4800" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x76d1413c" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28797", "parentcaller": "0x00b289c7", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 79 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06841000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06841000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03280000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28776", "parentcaller": "0x00b289c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03280000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b289ef", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x95o\\x9dvx\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x1e\\x01\\x00\\x00\\x88\\x1f+\\x03\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b28a0d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc8\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xd0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28a30", "parentcaller": "0x00b30a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x01 \\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00\\x88\\xfa\\xd9\\x02(\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28ac6", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28ad7", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "CopyFileExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75799730" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28aed", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "IsDebuggerPresent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x757a2770" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28afe", "parentcaller": "0x00b30a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SetConsoleInputExeNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76d9d1e0" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28b1e", "parentcaller": "0x00b30a55", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06844000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28b1e", "parentcaller": "0x00b30a55", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04d13000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b30b09", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Arguments", "value": "" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x02\\x01\\x01\\x08\\xf6\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xa3\\x00\\x00\\x00\\x10\\xf6\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x8c\\x00\\x00\\x00\\xe8\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06844000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06861000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b27ff9", "parentcaller": "0x00b2b0d4", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b27ff9", "parentcaller": "0x00b2b0d4", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b27ff9", "parentcaller": "0x00b2b0d4", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b27ff9", "parentcaller": "0x00b2b0d4", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x00000230" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0x94de425e" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b27ff9", "parentcaller": "0x00b2b0d4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b320d2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032d4000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b31d40", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b31d4a", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 107 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6d48", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FirstCreateTimeLow", "value": "0xc735815f" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcb202" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b28b81", "parentcaller": "0x00b2f9d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b32146", "parentcaller": "0x00b32229", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xf3\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xf3\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\xf4\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b3cb91", "parentcaller": "0x00b3214d", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x90\\x00\\x00\\x00\\x80\\xf3\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x96\\x00\\x00\\x00\\x88\\xf3\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x03\\x08\\x00\\x0b\\xb0%+\\x03\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4800" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-03-12 10:00:44,255", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "cmdext.dll" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-03-12 10:00:44,380", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\cmdext.dll" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-03-12 10:00:44,380", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\cmdext.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000230" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\cmdext.dll" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f610000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000a000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f617000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f616000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f616000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a09000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a09000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f616000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f616000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cmdext" }, { "name": "DllBase", "value": "0x6f610000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cmdext" }, { "name": "BaseAddress", "value": "0x6f610000" }, { "name": "InitRoutine", "value": "0x6f611d30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b6d000" }, { "name": "ModuleName", "value": "cmd.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b367a3", "parentcaller": "0x00b3734b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b6d000" }, { "name": "ModuleName", "value": "cmd.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f617000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-03-12 10:00:44,411", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x6f617000" }, { "name": "ModuleName", "value": "cmdext.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 133 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "misc", "api": "SaferIdentifyLevel", "status": true, "return": "0x00000001", "arguments": [], "repeated": 0, "id": 134 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000003", "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0002000a" }, { "name": "TokenHandle", "value": "0x00000248" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "8" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "xN)\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00\\x00\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00\\x00\\x00e\\x00m\\x00p\\x00\\\\x00\\x00\\x00e\\x00s\\x00t\\x00_\\x00w\\x00i\\x00n\\x00.\\x00b\\x00a\\x00t\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x19\r\\x00\\x00" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "15" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2fdc3", "parentcaller": "0x00b31b39", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b31d40", "parentcaller": "0x00b3003f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b31d4a", "parentcaller": "0x00b3003f", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 143 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04d13000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b30015", "parentcaller": "0x00b31b39", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0000c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b30015", "parentcaller": "0x00b31b39", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04d13000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-03-12 10:00:44,427", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 148 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "@echo off\necho CAPE Test Sample\necho Hostname: %COMPUTERNAME%\necho User: %USERNAME%\nipconfig\n" }, { "name": "Length", "value": "93" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b2d980", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b5000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b7ff", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 153 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06871000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0000c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b2b92d", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "echo" }, { "name": "Arguments", "value": " off" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xc0\\x94#\\x05(\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf0\\xee\\xd9\\x020\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\xf8\\xe9\\xd9\\x02\\x08\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06881000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06891000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b361fe", "parentcaller": "0x00b2e4f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc4\\xee\\xd9\\x02h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa7\\xbb\\xe5\tp\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b93c", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\xa7bo\\x80\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00,\\xec\\xd9\\x02\\xf8\\xec\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 170 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "echo CAPE Test Sample\necho Hostname: %COMPUTERNAME%\necho User: %USERNAME%\nipconfig\n" }, { "name": "Length", "value": "83" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b2d980", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032d1000" }, { "name": "RegionSize", "value": "0x00022000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b7ff", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 175 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b2b92d", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "echo" }, { "name": "Arguments", "value": " CAPE Test Sample" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x11\\x00\\x00\\x00(\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf0\\xee\\xd9\\x020\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\xf8\\xe9\\xd9\\x02\\x08\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b299a8", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b299fa", "parentcaller": "0x00b29df7", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a4" }, { "name": "Buffer", "value": "CAPE Test Sample\r\n" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b361fe", "parentcaller": "0x00b2e4f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc4\\xee\\xd9\\x02h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa7\\xbb\\xe5\tp\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b93c", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\xa7bo\\x80\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00,\\xec\\xd9\\x02\\xf8\\xec\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-03-12 10:00:44,442", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 191 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "echo Hostname: %COMPUTERNAME%\necho User: %USERNAME%\nipconfig\n" }, { "name": "Length", "value": "61" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ">\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 194 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b2b92d", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "echo" }, { "name": "Arguments", "value": " Hostname: DESKTOP-8SK9K6U" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe0\\xf8)\\x05(\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xc0\\x00\\xea\\x040\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x00\\xea\\xd9\\x02\\x08\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b299a8", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xea\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b299fa", "parentcaller": "0x00b29df7", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a4" }, { "name": "Buffer", "value": "Hostname: DESKTOP-8SK9K6U\r\n" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b361fe", "parentcaller": "0x00b2e4f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc4\\xee\\xd9\\x02h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa7\\xbb\\xe5\tp\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-03-12 10:00:44,474", "thread_id": "4800", "caller": "0x00b2b93c", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\xa7bo\\x80\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00,\\xec\\xd9\\x02\\xf8\\xec\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ">\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 210 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "echo User: %USERNAME%\nipconfig\n" }, { "name": "Length", "value": "31" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-03-12 10:00:44,489", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 213 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b2b92d", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "echo" }, { "name": "Arguments", "value": " User: malware" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x02\\xea\\x04(\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf0\\xee\\xd9\\x020\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\xf8\\xe9\\xd9\\x02\\x08\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b299a8", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\xde\\x02H\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\xde\\x02P\\xea\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b299fa", "parentcaller": "0x00b29df7", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a4" }, { "name": "Buffer", "value": "User: malware\r\n" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b361fe", "parentcaller": "0x00b2e4f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc4\\xee\\xd9\\x02h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa7\\xbb\\xe5\tp\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2b93c", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\xa7bo\\x80\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00,\\xec\\xd9\\x02\\xf8\\xec\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 229 }, { "timestamp": "2026-03-12 10:00:44,505", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "ipconfig\n" }, { "name": "Length", "value": "9" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 3, "id": 231 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b31d40", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b31d4a", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 235 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\ipconfig.*" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a69c8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.*" }, { "name": "FirstCreateTimeLow", "value": "0x18e813a9" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b28b81", "parentcaller": "0x00b2942d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.COM" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6908", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.exe" }, { "name": "FirstCreateTimeLow", "value": "0x18e813a9" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b28b81", "parentcaller": "0x00b2942d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2fa3e", "parentcaller": "0x00b2ba87", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2e4f6", "parentcaller": "0x00b2b92d", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "ipconfig" }, { "name": "Arguments", "value": "" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2adbc", "parentcaller": "0x00b2e4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xc0\\x94#\\x05(\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf0\\xee\\xd9\\x020\\xea\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\xf8\\xe9\\xd9\\x02\\x08\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b3744a", "parentcaller": "0x00b36e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2dcee", "parentcaller": "0x00b320d2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032f4000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b31d40", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b31d4a", "parentcaller": "0x00b2f680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 248 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\ipconfig.*" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6e08", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.*" }, { "name": "FirstCreateTimeLow", "value": "0x18e813a9" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b28b81", "parentcaller": "0x00b2942d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.COM" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b358c1", "parentcaller": "0x00b29c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x032a6dc8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ipconfig.exe" }, { "name": "FirstCreateTimeLow", "value": "0x18e813a9" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b28b81", "parentcaller": "0x00b2942d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b320eb", "parentcaller": "0x00b32229", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xe7\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xe7\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x00\\x00\\x00\\x00|\\xe8\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000e0" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x75780000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7579eeb0" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x75780000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x757997e0" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000240" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06930000" }, { "name": "SectionOffset", "value": "0x02d9e3b4" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b295be", "parentcaller": "0x00b32107", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b2825c", "parentcaller": "0x00b32107", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x80w\\xaa\\x06\\xe8\\xe6\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0e\\x02\\x12\\x00\\xf0\\xe6\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-03-12 10:00:44,521", "thread_id": "4800", "caller": "0x00b28272", "parentcaller": "0x00b32107", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x80w\\xaa\\x06\\xe8\\xe6\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0e\\x02\\x12\\x00\\xf0\\xe6\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-03-12 10:00:44,552", "thread_id": "4800", "caller": "0x00b29608", "parentcaller": "0x00b32107", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000022c" }, { "name": "ThreadHandle", "value": "0x00000230" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\ipconfig.exe" }, { "name": "CommandLine", "value": "ipconfig" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1532" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-03-12 10:00:44,646", "thread_id": "4800", "caller": "0x00b29608", "parentcaller": "0x00b32107", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x778e0000" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-03-12 10:00:44,677", "thread_id": "4800", "caller": "0x00b29608", "parentcaller": "0x00b32107", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "4800" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x76d1416c" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-03-12 10:00:44,677", "thread_id": "4800", "caller": "0x00b29608", "parentcaller": "0x00b32107", "category": "process", "api": "CreateProcessW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\ipconfig.exe" }, { "name": "CommandLine", "value": "ipconfig" }, { "name": "CreationFlags", "value": "0x00080000" }, { "name": "ProcessId", "value": "1532" }, { "name": "ThreadId", "value": "2704" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000022c" }, { "name": "ThreadHandle", "value": "0x00000230" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-03-12 10:00:44,677", "thread_id": "4800", "caller": "0x00b2962a", "parentcaller": "0x00b32107", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-03-12 10:00:44,677", "thread_id": "4800", "caller": "0x00b28209", "parentcaller": "0x00b29692", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2822f", "parentcaller": "0x00b29692", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b361fe", "parentcaller": "0x00b2e4f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc4\\xee\\xd9\\x02h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa7\\xbb\\xe5\tp\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e3d7", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e3a0", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2b93c", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xef\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\xa7bo\\x80\\xef\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b31b56", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00,\\xec\\xd9\\x02\\xf8\\xec\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06874000" }, { "name": "RegionSize", "value": "0x0002c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2b973", "parentcaller": "0x00b31b56", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b30605", "parentcaller": "0x00b2e286", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2e2a9", "parentcaller": "0x00b31b56", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b2b7f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032e1000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b2b7f6", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032e1000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b2b7f6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032d1000" }, { "name": "RegionSize", "value": "0x00042000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b2b7f6", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032d1000" }, { "name": "RegionSize", "value": "0x00042000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2d716", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 293 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": false, "return": "0xffffffffc0000011", "pretty_return": "END_OF_FILE", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "" }, { "name": "Length", "value": "0" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-03-12 10:00:45,317", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "`\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 296 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2d737", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtReadFile", "status": false, "return": "0xffffffffc0000011", "pretty_return": "END_OF_FILE", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "Buffer", "value": "" }, { "name": "Length", "value": "0" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "`\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2d964", "parentcaller": "0x00b380cd", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "]\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 299 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2b832", "parentcaller": "0x00b31b56", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b31baa", "parentcaller": "0x00b32164", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06864000" }, { "name": "RegionSize", "value": "0x0003c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2e328", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xbc,\\x95wX\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2e33f", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2e36e", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b30aa9", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2e2c8", "parentcaller": "0x00b36a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14\\xf8\\xd9\\x02\\xe0\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b2ddf6", "parentcaller": "0x00b3eab1", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfb\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36472", "parentcaller": "0x00b362fa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000022c" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36530", "parentcaller": "0x00b3648a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b364ef", "parentcaller": "0x00b364a8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "26" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b364c3", "parentcaller": "0x00b362fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04c30000" }, { "name": "RegionSize", "value": "0x00021000" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\en-US\\cmd.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000011c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\cmd.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000011c" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\cmd.exe.mui" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04c30000" }, { "name": "SectionOffset", "value": "0x02d9ea68" }, { "name": "ViewSize", "value": "0x00021000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-03-12 10:00:45,333", "thread_id": "4800", "caller": "0x00b36435", "parentcaller": "0x00b36332", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b41f71", "parentcaller": "0x00b3eacc", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xa4\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00Z\\x00\\x00\\x00d\\xf9\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b2793a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\xff\\xffp\\xf8\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27957", "parentcaller": "0x00b27908", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\xc0\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00(\\xf8\\xd9\\x02\\xc8\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000022c" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\KernelBase.dll.mui" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000024c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06c70000" }, { "name": "SectionOffset", "value": "0x02d9e960" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b27eda", "parentcaller": "0x00b2797e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b279c4", "parentcaller": "0x00b27908", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a8" }, { "name": "Buffer", "value": "Not enough memory resources are available to process this command.\r\n" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b3eafa", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032d1000" }, { "name": "RegionSize", "value": "0x00042000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b3eafa", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032bd000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b3eafa", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b3eafa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032bd000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2c5ca", "parentcaller": "0x00b3eafa", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x032b8000" }, { "name": "RegionSize", "value": "0x00018000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b299a8", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xb8\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1c\\xf8\\xd9\\x02\\xc0\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b299fa", "parentcaller": "0x00b47746", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a4" }, { "name": "Buffer", "value": "\r\n" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b29a67", "parentcaller": "0x00b299a8", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xf7\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b299fa", "parentcaller": "0x00b47cfe", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x000000a4" }, { "name": "Buffer", "value": "C:\\Users\\malware\\AppData\\Local\\Temp>" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b2ddf6", "parentcaller": "0x00b3d5cd", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xf8\\xfa\\xd9\\x02\\x98\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf8\\xfa\\xd9\\x02\\xa0\\xfa\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 1, "id": 339 }, { "timestamp": "2026-03-12 10:00:45,349", "thread_id": "4800", "caller": "0x00b4420b", "parentcaller": "0x00b3d665", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000090" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00d\\x00\\x00\\x00B\\x00\\x00\\x00\\x80\\xf9\\xd9\\x02\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00t\\xf8\\xd9\\x02\\x88\\xf9\\xd9\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 340 } ], "threads": [ "4800", "3740", "4788", "5984", "6108" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b20000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 1532, "process_name": "ipconfig.exe", "parent_id": 3040, "module_path": "C:\\Windows\\SysWOW64\\ipconfig.exe", "first_seen": "2026-03-12 10:00:44,754", "calls": [ { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x7794baf4", "parentcaller": "0x742aeb95", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x7794baf4", "parentcaller": "0x742aeb95", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dhcpcsvc" }, { "name": "BaseAddress", "value": "0x742a0000" }, { "name": "InitRoutine", "value": "0x742a42f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x7794baf4", "parentcaller": "0x6f5f69a8", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "Kernel-OneCore-DeviceFamilyID" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x7794baf4", "parentcaller": "0x6f5f69a8", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dhcpcsvc6" }, { "name": "BaseAddress", "value": "0x6f5f0000" }, { "name": "InitRoutine", "value": "0x6f5f2f20" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "2704", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "4700", "caller": "0x77931bae", "parentcaller": "0x7792db51", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000084" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 3, "id": 6 }, { "timestamp": "2026-03-12 10:00:45,129", "thread_id": "4352", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xf2X\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xf2X\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "2704", "caller": "0x00254f5a", "parentcaller": "0x0025500e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045c3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xd0n\\x0b\\x00\\x00\\x00\\x00\\x00V\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00R\\xe7\n\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd5\\xb4\\x02\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x18\\xb4V\\xad\\xf9\\xcf\\x1f\\x17=x\\x8e\\x98\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x779207f7", "parentcaller": "0x779204ff", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045c4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x779207f7", "parentcaller": "0x779204ff", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045c6000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x7791133f", "parentcaller": "0x779110ba", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x7791135c", "parentcaller": "0x779110ba", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x77911372", "parentcaller": "0x779110ba", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x7790effb", "parentcaller": "0x7790eef0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045b0000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x7790f042", "parentcaller": "0x7790eef0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 18 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4352", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4700", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x008\\xf6P\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff@\\xf6P\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4700", "caller": "0x779207f7", "parentcaller": "0x779204ff", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x045c8000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4700", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 22 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "4700", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "5024", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00x\\xf2H\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x80\\xf2H\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "5024", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "5024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "3864", "caller": "0x76ced7d2", "parentcaller": "0x76ced6e8", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x88\\x00\\x00\\x00\\x80\\xf4@\\x04\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\x88\\xf4@\\x04\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "3864", "caller": "0x779207f7", "parentcaller": "0x779204ff", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02b53000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "3864", "caller": "0x779464c6", "parentcaller": "0x779463d1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 29 }, { "timestamp": "2026-03-12 10:00:45,145", "thread_id": "3864", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-03-12 10:00:45,161", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "2704" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x76d1413c" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254721", "parentcaller": "0x0025506a", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x0025472a", "parentcaller": "0x0025506a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xf4\\xf4\\x89\\x02\\xc0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254c86", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00?\\\\x04\\x00\\xf8\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xcc\\x9cv\\x08\\xf8\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ae0000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\en-US\\ipconfig.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000130" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\ipconfig.exe.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000130" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\ipconfig.exe.mui" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ae0000" }, { "name": "SectionOffset", "value": "0x0289e988" }, { "name": "ViewSize", "value": "0x00007000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e9c", "parentcaller": "0x0025486c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd8\\xf7\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xe0\\xf7\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-03-12 10:00:45,176", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xaa\\\\x92w\\x18\\xdc\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x04\\xde\\x89\\x02 \\xdc\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\xde\\x89\\x02 \\xdc\\x89\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xb8\\xdc\\x89\\x02(\\xdc\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\CONOUT$" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "W" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "d" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "w" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "s" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "I" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "P" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "C" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "f" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "g" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "u" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 1, "id": 82 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-03-12 10:00:45,192", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x0025416d", "parentcaller": "0x002549e8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 85 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x0025416d", "parentcaller": "0x002549e8", "category": "network", "api": "GetAdaptersAddresses", "status": false, "return": "0x0000006f", "arguments": [], "repeated": 0, "id": 86 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x0025416d", "parentcaller": "0x002549e8", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 87 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xe0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00p\\x02]\\x04\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x689\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00 \\x00\\x00\\x00(\\x689\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "E" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "h" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "d" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "p" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "E" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-03-12 10:00:45,207", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "h" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 1, "id": 122 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xe0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x689\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00 \\x00\\x00\\x00(\\x689\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 2, "id": 128 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "C" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 1, "id": 131 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "c" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "-" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "s" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "p" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "c" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "f" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "c" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "D" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "N" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "S" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "S" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "u" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "f" } ], "repeated": 1, "id": 154 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "x" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 1, "id": 157 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\x689\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x689\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 2, "id": 168 }, { "timestamp": "2026-03-12 10:00:45,223", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "L" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "i" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "k" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "-" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "l" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "o" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "c" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "l" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "I" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "P" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "v" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "6" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "A" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "d" } ], "repeated": 1, "id": 186 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "s" } ], "repeated": 1, "id": 189 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "f" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "8" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "0" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 1, "id": 207 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "3" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "6" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "4" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "8" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "8" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 1, "id": 215 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "4" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "7" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "9" } ], "repeated": 1, "id": 223 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-03-12 10:00:45,239", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "%" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\x689\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x689\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 2, "id": 233 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "I" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "P" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "v" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "4" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "A" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "d" } ], "repeated": 1, "id": 240 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "r" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "s" } ], "repeated": 1, "id": 243 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "9" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "6" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "8" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 1, "id": 276 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "0" } ], "repeated": 1, "id": 279 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xe0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x8c\\xd9\\x89\\x02(\\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 2, "id": 286 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "S" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "u" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "b" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "n" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "M" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "s" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "k" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 1, "id": 324 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 1, "id": 327 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 1, "id": 330 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "0" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254b9d", "parentcaller": "0x00254d62", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\xd8\\xf5\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd3'\\x92w\\xe0\\xf5\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xda\\x89\\x02\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x8c\\xd9\\x89\\x02(\\xda\\x89\\x02\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 2, "id": 339 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "D" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "f" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "u" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "l" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "G" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "t" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "e" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "w" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-03-12 10:00:45,254", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "a" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "y" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": ":" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": " " } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "9" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "2" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "6" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "8" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "5" } ], "repeated": 1, "id": 384 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "." } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "1" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\n" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x00254e42", "parentcaller": "0x00254eab", "category": "system", "api": "WriteConsoleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ConsoleHandle", "value": "0x00000230" }, { "name": "Buffer", "value": "\r" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x045c1bf8" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-03-12 10:00:45,286", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e8" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c8" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e02000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75e02000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7793f590" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7793f590" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000114" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000114" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000114" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000114" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7793f590" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x778e0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7793f590" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b0" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c0" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c4" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-03-12 10:00:45,301", "thread_id": "2704", "caller": "0x002547eb", "parentcaller": "0x0025506a", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 457 } ], "threads": [ "2704", "4700", "4352", "5024", "3864" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "ipconfig", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00250000", "MainExeSize": "0x0000b000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "cmd.exe", "pid": 1732, "parent_id": 5060, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "children": [ { "name": "cmd.exe", "pid": 3040, "parent_id": 1732, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "children": [ { "name": "ipconfig.exe", "pid": 1532, "parent_id": 3040, "module_path": "C:\\Windows\\SysWOW64\\ipconfig.exe", "children": [], "threads": [ "2704", "4700", "4352", "5024", "3864" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "ipconfig", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00250000", "MainExeSize": "0x0000b000", "Bitness": "32-bit" } } ], "threads": [ "4800", "3740", "4788", "5984", "6108" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b20000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" } } ], "threads": [ "3796", "4104", "4316", "4232", "1160", "272", "2264" ], "environ": { "UserName": "malware", "ComputerName": "DESKTOP-8SK9K6U", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\malware\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "94de-425e", "SystemVolumeGUID": "66ff5cdc-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00b20000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" } } ], "summary": { "files": [ "C:\\Users\\malware\\AppData\\Local\\Temp", "C:\\Users", "C:\\Users\\malware", "C:\\Users\\malware\\AppData", "C:\\Users\\malware\\AppData\\Local", "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat", "C:\\", "C:\\Windows\\System32\\cmdext.dll", "C:\\Users\\malware\\AppData\\Local\\Temp\\ipconfig.*", "C:\\Windows\\System32\\ipconfig.*", "C:\\Windows\\System32\\ipconfig.COM", "C:\\Windows\\System32\\ipconfig.exe", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Windows\\SysWOW64\\en-US\\cmd.exe.mui", "C:\\Windows\\sysnative\\en-US\\cmd.exe.mui", "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\sysnative\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\SysWOW64\\en-US\\ipconfig.exe.mui", "C:\\Windows\\sysnative\\en-US\\ipconfig.exe.mui", "\\??\\CONOUT$" ], "read_files": [], "write_files": [ "\\??\\CONOUT$" ], "delete_files": [], "keys": [ "HKEY_CURRENT_USER", "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "write_keys": [], "delete_keys": [], "executed_commands": [ "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"", "ipconfig" ], "resolved_apis": [], "mutexes": [], "created_services": [], "started_services": [] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:43,677", "eid": 1, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 2, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 3, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 4, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 5, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 6, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 7, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,692", "eid": 8, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,739", "eid": 9, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,739", "eid": 10, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:43,739", "eid": 11, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:43,739", "eid": 12, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:43,849", "eid": 13, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x778e0000" } }, { "event": "execute", "object": "file", "timestamp": "2026-03-12 10:00:43,864", "eid": 14, "data": { "file": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:44,255", "eid": 15, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 16, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 17, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 18, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 19, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 20, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 21, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 22, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 23, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 24, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,255", "eid": 25, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:44,255", "eid": 26, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:44,442", "eid": 27, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:44,442", "eid": 28, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:44,474", "eid": 29, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:44,489", "eid": 30, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:44,505", "eid": 31, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,521", "eid": 32, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:44,521", "eid": 33, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x75780000" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,521", "eid": 34, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:44,521", "eid": 35, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:44,646", "eid": 36, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x778e0000" } }, { "event": "execute", "object": "file", "timestamp": "2026-03-12 10:00:44,677", "eid": 37, "data": { "file": null } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:45,317", "eid": 38, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "file", "timestamp": "2026-03-12 10:00:45,333", "eid": 39, "data": { "file": "C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:45,145", "eid": 40, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:45,176", "eid": 41, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:45,176", "eid": 42, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:45,286", "eid": 43, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:45,301", "eid": 44, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:45,301", "eid": 45, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-12 10:00:45,301", "eid": 46, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-12 10:00:45,301", "eid": 47, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [] } }, "debug": { "log": "2026-03-12 02:29:53,127 [root] INFO: Date set to: 20260312T03:00:28, timeout set to: 60\n2026-03-12 03:00:28,052 [root] DEBUG: Starting analyzer from: C:\\fo70alm8\n2026-03-12 03:00:28,083 [root] DEBUG: Storing results at: C:\\JRAvHIbPg\n2026-03-12 03:00:28,083 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\bHDIIWOIat\n2026-03-12 03:00:28,083 [root] DEBUG: Python path: C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32\n2026-03-12 03:00:28,099 [root] INFO: analysis running as an admin\n2026-03-12 03:00:28,099 [root] DEBUG: no analysis package configured, picking one for you\n2026-03-12 03:00:28,130 [root] INFO: analysis package selected: \"batch\"\n2026-03-12 03:00:28,161 [root] DEBUG: importing analysis package module: \"modules.packages.batch\"...\n2026-03-12 03:00:28,255 [root] DEBUG: imported analysis package \"batch\"\n2026-03-12 03:00:28,255 [root] DEBUG: initializing analysis package \"batch\"...\n2026-03-12 03:00:28,255 [lib.common.common] INFO: wrapping\n2026-03-12 03:00:28,255 [lib.core.compound] INFO: C:\\Users\\malware\\AppData\\Local\\Temp already exists, skipping creation\n2026-03-12 03:00:28,255 [root] DEBUG: New location of moved file: C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\n2026-03-12 03:00:28,255 [root] INFO: Analyzer: Package modules.packages.batch does not specify a DLL option\n2026-03-12 03:00:28,255 [root] INFO: Analyzer: Package modules.packages.batch does not specify a DLL_64 option\n2026-03-12 03:00:28,255 [root] INFO: Analyzer: Package modules.packages.batch does not specify a loader option\n2026-03-12 03:00:28,255 [root] INFO: Analyzer: Package modules.packages.batch does not specify a loader_64 option\n2026-03-12 03:00:28,770 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-03-12 03:00:28,770 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-03-12 03:00:29,082 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-03-12 03:00:29,145 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-03-12 03:00:29,192 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-03-12 03:00:29,192 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-03-12 03:00:29,192 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-03-12 03:00:29,208 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-03-12 03:00:29,223 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-03-12 03:00:29,223 [root] DEBUG: attempting to configure 'Browser' from data\n2026-03-12 03:00:29,223 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-03-12 03:00:29,223 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-03-12 03:00:29,223 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-03-12 03:00:29,239 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-03-12 03:00:29,239 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-03-12 03:00:29,239 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-03-12 03:00:29,239 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-03-12 03:00:29,239 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-03-12 03:00:29,708 [modules.auxiliary.digisig] DEBUG: File format not recognized\n2026-03-12 03:00:29,708 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-03-12 03:00:29,739 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-03-12 03:00:29,739 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-03-12 03:00:29,739 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-03-12 03:00:29,755 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-03-12 03:00:29,755 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-03-12 03:00:29,770 [modules.auxiliary.disguise] INFO: Disguising GUID to 3f5cd452-90a2-4074-9dda-8e5accc5f56e\n2026-03-12 03:00:29,770 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-03-12 03:00:29,770 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-03-12 03:00:29,770 [root] DEBUG: attempting to configure 'Human' from data\n2026-03-12 03:00:29,786 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-03-12 03:00:29,786 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-03-12 03:00:30,364 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-03-12 03:00:30,380 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-03-12 03:00:30,380 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-03-12 03:00:30,395 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-03-12 03:00:30,411 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-03-12 03:00:30,411 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-03-12 03:00:30,411 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-03-12 03:00:30,411 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-03-12 03:00:30,411 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-03-12 03:00:30,427 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-03-12 03:00:30,427 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-03-12 03:00:30,427 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 656\n2026-03-12 03:00:30,505 [lib.api.process] INFO: Monitor config for : C:\\fo70alm8\\dll\\656.ini\n2026-03-12 03:00:30,505 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor\n2026-03-12 03:00:30,536 [lib.api.process] INFO: 64-bit DLL to inject is C:\\fo70alm8\\dll\\bdnwbBbZ.dll, loader C:\\fo70alm8\\bin\\LQLZcLnO.exe\n2026-03-12 03:00:30,661 [root] DEBUG: Loader: Injecting process 656 with C:\\fo70alm8\\dll\\bdnwbBbZ.dll.\n2026-03-12 03:00:30,708 [root] DEBUG: 656: Python path set to 'C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32'.\n2026-03-12 03:00:30,723 [root] DEBUG: 656: Disabling sleep skipping.\n2026-03-12 03:00:30,723 [root] DEBUG: 656: TLS secret dump mode enabled.\n2026-03-12 03:00:30,786 [root] DEBUG: 656: RtlInsertInvertedFunctionTable 0x00007FFE45A6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFE45BBD510\n2026-03-12 03:00:30,786 [root] DEBUG: 656: Monitor initialised: 64-bit capemon loaded in process 656 at 0x00007FFE1EBA0000, thread 1932, image base 0x00007FF7509D0000, stack from 0x0000006D74372000-0x0000006D74380000\n2026-03-12 03:00:30,786 [root] DEBUG: 656: Commandline: C:\\Windows\\system32\\lsass.exe\n2026-03-12 03:00:30,833 [root] DEBUG: 656: Hooked 5 out of 5 functions\n2026-03-12 03:00:30,833 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-03-12 03:00:30,833 [root] DEBUG: Successfully injected DLL C:\\fo70alm8\\dll\\bdnwbBbZ.dll.\n2026-03-12 03:00:30,848 [lib.api.process] INFO: Injected into 64-bit \n2026-03-12 03:00:30,848 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-03-12 03:00:38,536 [root] INFO: Restarting WMI Service\n2026-03-12 03:00:40,724 [root] DEBUG: package modules.packages.batch does not support configure, ignoring\n2026-03-12 03:00:40,739 [root] WARNING: configuration error for package modules.packages.batch: error importing data.packages.batch: No module named 'data.packages'\n2026-03-12 03:00:40,739 [lib.core.compound] INFO: C:\\Users\\malware\\AppData\\Local\\Temp already exists, skipping creation\n2026-03-12 03:00:40,755 [lib.api.process] INFO: Successfully executed process from path \"C:\\Windows\\system32\\cmd.exe\" with arguments \"/c start /wait \"\" \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"\" with pid 1732\n2026-03-12 03:00:40,755 [lib.api.process] INFO: Monitor config for : C:\\fo70alm8\\dll\\1732.ini\n2026-03-12 03:00:40,786 [lib.api.process] INFO: 32-bit DLL to inject is C:\\fo70alm8\\dll\\orRMvWuZ.dll, loader C:\\fo70alm8\\bin\\rcnLFnZ.exe\n2026-03-12 03:00:40,880 [root] DEBUG: Loader: Injecting process 1732 (thread 3796) with C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:40,880 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-03-12 03:00:40,880 [root] DEBUG: Successfully injected DLL C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:40,895 [lib.api.process] INFO: Injected into 32-bit \n2026-03-12 03:00:42,911 [lib.api.process] INFO: Successfully resumed \n2026-03-12 03:00:43,317 [root] DEBUG: 1732: Python path set to 'C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32'.\n2026-03-12 03:00:43,317 [root] DEBUG: 1732: Disabling sleep skipping.\n2026-03-12 03:00:43,333 [root] DEBUG: 1732: Dropped file limit defaulting to 100.\n2026-03-12 03:00:43,364 [root] DEBUG: 1732: YaraInit: Compiled 44 rule files\n2026-03-12 03:00:43,396 [root] DEBUG: 1732: YaraInit: Compiled rules saved to file C:\\fo70alm8\\data\\yara\\capemon.yac\n2026-03-12 03:00:43,396 [root] DEBUG: 1732: YaraScan: Scanning 0x00B20000, size 0x595ee\n2026-03-12 03:00:43,411 [root] DEBUG: 1732: YaraScan hit: FindFixAndRun\n2026-03-12 03:00:43,411 [root] DEBUG: 1732: Monitor initialised: 32-bit capemon loaded in process 1732 at 0x6f620000, thread 3796, image base 0xb20000, stack from 0xa03000-0xb00000\n2026-03-12 03:00:43,411 [root] DEBUG: 1732: Commandline: \"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"\n2026-03-12 03:00:43,489 [root] DEBUG: 1732: hook_api: LdrpCallInitRoutine export address 0x77952A30 obtained via GetFunctionAddress\n2026-03-12 03:00:43,552 [root] WARNING: b'Unable to place hook on GetCommandLineA'\n2026-03-12 03:00:43,552 [root] DEBUG: 1732: set_hooks: Unable to hook GetCommandLineA\n2026-03-12 03:00:43,552 [root] WARNING: b'Unable to place hook on GetCommandLineW'\n2026-03-12 03:00:43,552 [root] DEBUG: 1732: set_hooks: Unable to hook GetCommandLineW\n2026-03-12 03:00:43,552 [root] DEBUG: 1732: Hooked 630 out of 632 functions\n2026-03-12 03:00:43,552 [root] DEBUG: 1732: set_hooks_exe: Hooked FindFixAndRun at 0x00B2AD60\n2026-03-12 03:00:43,552 [root] DEBUG: 1732: Syscall hook installed, syscall logging level 1\n2026-03-12 03:00:43,645 [root] DEBUG: 1732: RestoreHeaders: Restored original import table.\n2026-03-12 03:00:43,645 [root] INFO: Loaded monitor into process with pid 1732\n2026-03-12 03:00:43,645 [root] DEBUG: 1732: caller_dispatch: Added region at 0x00B20000 to tracked regions list (ntdll::NtOpenThread returns to 0x00B309DE, thread 3796).\n2026-03-12 03:00:43,661 [root] DEBUG: 1732: YaraScan: Scanning 0x00B20000, size 0x595ee\n2026-03-12 03:00:43,677 [root] DEBUG: 1732: ProcessImageBase: Main module image at 0x00B20000 unmodified (entropy change 0.000000e+00)\n2026-03-12 03:00:43,739 [root] DEBUG: 1732: InstrumentationCallback: Added region at 0x76D1413C (base 0x76BD0000) to tracked regions list (thread 3796).\n2026-03-12 03:00:43,739 [root] DEBUG: 1732: ProcessTrackedRegion: Region at 0x76BD0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-12 03:00:43,755 [root] DEBUG: 1732: CreateProcessHandler: Injection info set for new process 3040: C:\\Windows\\system32\\cmd.exe, ImageBase: 0x00B20000\n2026-03-12 03:00:43,755 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3040\n2026-03-12 03:00:43,755 [lib.api.process] INFO: Monitor config for : C:\\fo70alm8\\dll\\3040.ini\n2026-03-12 03:00:43,786 [lib.api.process] INFO: 32-bit DLL to inject is C:\\fo70alm8\\dll\\orRMvWuZ.dll, loader C:\\fo70alm8\\bin\\rcnLFnZ.exe\n2026-03-12 03:00:43,833 [root] DEBUG: Loader: Injecting process 3040 (thread 4800) with C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:43,833 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-03-12 03:00:43,833 [root] DEBUG: Successfully injected DLL C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:43,849 [lib.api.process] INFO: Injected into 32-bit \n2026-03-12 03:00:43,865 [root] DEBUG: 1732: ProcessTrackedRegion: Region at 0x76BD0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-12 03:00:44,052 [root] DEBUG: 3040: Python path set to 'C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32'.\n2026-03-12 03:00:44,052 [root] DEBUG: 3040: Disabling sleep skipping.\n2026-03-12 03:00:44,052 [root] DEBUG: 3040: Dropped file limit defaulting to 100.\n2026-03-12 03:00:44,067 [root] DEBUG: 3040: YaraInit: Compiled rules loaded from existing file C:\\fo70alm8\\data\\yara\\capemon.yac\n2026-03-12 03:00:44,083 [root] DEBUG: 3040: YaraScan: Scanning 0x00B20000, size 0x595ee\n2026-03-12 03:00:44,083 [root] DEBUG: 3040: YaraScan hit: FindFixAndRun\n2026-03-12 03:00:44,083 [root] DEBUG: 3040: Monitor initialised: 32-bit capemon loaded in process 3040 at 0x6f620000, thread 4800, image base 0xb20000, stack from 0x2ca3000-0x2da0000\n2026-03-12 03:00:44,083 [root] DEBUG: 3040: Commandline: C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"\n2026-03-12 03:00:44,146 [root] DEBUG: 3040: hook_api: LdrpCallInitRoutine export address 0x77952A30 obtained via GetFunctionAddress\n2026-03-12 03:00:44,177 [root] WARNING: b'Unable to place hook on GetCommandLineA'\n2026-03-12 03:00:44,193 [root] DEBUG: 3040: set_hooks: Unable to hook GetCommandLineA\n2026-03-12 03:00:44,193 [root] WARNING: b'Unable to place hook on GetCommandLineW'\n2026-03-12 03:00:44,208 [root] DEBUG: 3040: set_hooks: Unable to hook GetCommandLineW\n2026-03-12 03:00:44,224 [root] DEBUG: 3040: Hooked 630 out of 632 functions\n2026-03-12 03:00:44,224 [root] DEBUG: 3040: set_hooks_exe: Hooked FindFixAndRun at 0x00B2AD60\n2026-03-12 03:00:44,240 [root] DEBUG: 3040: Syscall hook installed, syscall logging level 1\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: RestoreHeaders: Restored original import table.\n2026-03-12 03:00:44,255 [root] INFO: Loaded monitor into process with pid 3040\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: caller_dispatch: Added region at 0x00B20000 to tracked regions list (ntdll::NtOpenThread returns to 0x00B309DE, thread 4800).\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: YaraScan: Scanning 0x00B20000, size 0x595ee\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: ProcessImageBase: Main module image at 0x00B20000 unmodified (entropy change 0.000000e+00)\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: InstrumentationCallback: Added region at 0x76D1413C (base 0x76BD0000) to tracked regions list (thread 4800).\n2026-03-12 03:00:44,255 [root] DEBUG: 3040: ProcessTrackedRegion: Region at 0x76BD0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-12 03:00:44,411 [root] DEBUG: 3040: DLL loaded at 0x6F610000: C:\\Windows\\SYSTEM32\\cmdext (0xa000 bytes).\n2026-03-12 03:00:44,552 [root] DEBUG: 3040: CreateProcessHandler: Injection info set for new process 1532: C:\\Windows\\system32\\ipconfig.exe, ImageBase: 0x00250000\n2026-03-12 03:00:44,552 [root] INFO: Announced 32-bit process name: ipconfig.exe pid: 1532\n2026-03-12 03:00:44,567 [lib.api.process] INFO: Monitor config for : C:\\fo70alm8\\dll\\1532.ini\n2026-03-12 03:00:44,583 [lib.api.process] INFO: 32-bit DLL to inject is C:\\fo70alm8\\dll\\orRMvWuZ.dll, loader C:\\fo70alm8\\bin\\rcnLFnZ.exe\n2026-03-12 03:00:44,630 [root] DEBUG: Loader: Injecting process 1532 (thread 2704) with C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:44,630 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-03-12 03:00:44,645 [root] DEBUG: Successfully injected DLL C:\\fo70alm8\\dll\\orRMvWuZ.dll.\n2026-03-12 03:00:44,645 [lib.api.process] INFO: Injected into 32-bit \n2026-03-12 03:00:44,677 [root] DEBUG: 3040: ProcessTrackedRegion: Region at 0x76BD0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-12 03:00:44,740 [root] DEBUG: 1532: Python path set to 'C:\\Users\\malware\\AppData\\Local\\Programs\\Python\\Python310-32'.\n2026-03-12 03:00:44,754 [root] DEBUG: 1532: Dropped file limit defaulting to 100.\n2026-03-12 03:00:44,754 [root] DEBUG: 1532: Disabling sleep skipping.\n2026-03-12 03:00:44,961 [root] DEBUG: 1532: YaraInit: Compiled rules loaded from existing file C:\\fo70alm8\\data\\yara\\capemon.yac\n2026-03-12 03:00:44,973 [root] DEBUG: 1532: YaraScan: Scanning 0x00250000, size 0xa412\n2026-03-12 03:00:44,973 [root] DEBUG: 1532: Monitor initialised: 32-bit capemon loaded in process 1532 at 0x6f620000, thread 2704, image base 0x250000, stack from 0x2894000-0x28a0000\n2026-03-12 03:00:44,973 [root] DEBUG: 1532: Commandline: ipconfig\n2026-03-12 03:00:45,021 [root] DEBUG: 1532: hook_api: LdrpCallInitRoutine export address 0x77952A30 obtained via GetFunctionAddress\n2026-03-12 03:00:45,068 [root] WARNING: b'Unable to place hook on GetCommandLineA'\n2026-03-12 03:00:45,068 [root] DEBUG: 1532: set_hooks: Unable to hook GetCommandLineA\n2026-03-12 03:00:45,068 [root] WARNING: b'Unable to place hook on GetCommandLineW'\n2026-03-12 03:00:45,068 [root] DEBUG: 1532: set_hooks: Unable to hook GetCommandLineW\n2026-03-12 03:00:45,099 [root] DEBUG: 1532: Hooked 630 out of 632 functions\n2026-03-12 03:00:45,099 [root] DEBUG: 1532: Syscall hook installed, syscall logging level 1\n2026-03-12 03:00:45,114 [root] DEBUG: 1532: RestoreHeaders: Restored original import table.\n2026-03-12 03:00:45,114 [root] INFO: Loaded monitor into process with pid 1532\n2026-03-12 03:00:45,114 [root] DEBUG: 1532: caller_dispatch: Added region at 0x00250000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00254F5A, thread 2704).\n2026-03-12 03:00:45,114 [root] DEBUG: 1532: YaraScan: Scanning 0x00250000, size 0xa412\n2026-03-12 03:00:45,130 [root] DEBUG: 1532: ProcessImageBase: Main module image at 0x00250000 unmodified (entropy change 0.000000e+00)\n2026-03-12 03:00:45,161 [root] DEBUG: 1532: InstrumentationCallback: Added region at 0x76D1413C (base 0x76BD0000) to tracked regions list (thread 2704).\n2026-03-12 03:00:45,161 [root] DEBUG: 1532: ProcessTrackedRegion: Region at 0x76BD0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-12 03:00:45,270 [root] DEBUG: 1532: NtTerminateProcess hook: Attempting to dump process 1532\n2026-03-12 03:00:45,286 [root] DEBUG: 1532: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-03-12 03:00:45,302 [root] INFO: Process with pid 1532 has terminated\n2026-03-12 03:01:43,161 [root] INFO: Analysis timeout hit, terminating analysis\n2026-03-12 03:01:43,161 [lib.api.process] INFO: Terminate event set for \n2026-03-12 03:01:43,161 [root] DEBUG: 1732: Terminate Event: Attempting to dump process 1732\n2026-03-12 03:01:43,176 [root] DEBUG: 1732: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching\n2026-03-12 03:01:43,176 [root] DEBUG: 1732: DoProcessDump: Code modification detected, dumping Imagebase at 0x00B20000.\n2026-03-12 03:01:43,176 [root] DEBUG: 1732: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-03-12 03:01:43,192 [root] DEBUG: 1732: DumpProcess: Instantiating PeParser with address: 0x00B20000.\n2026-03-12 03:01:43,192 [root] DEBUG: 1732: DumpProcess: Module entry point VA is 0x00B36B20.\n2026-03-12 03:01:43,317 [lib.common.results] INFO: Uploading file C:\\JRAvHIbPg\\CAPE\\1732_123414311012432026 to procdump\\b77a8d902a6d61b3739f4c1fbad4d7a19e54f8538a340bf68df594a6b72d23a8; Size is 346624; Max size: 100000000\n2026-03-12 03:01:43,349 [root] DEBUG: 1732: DumpProcess: Module image dump success - dump size 0x54a00.\n2026-03-12 03:01:43,380 [lib.api.process] INFO: Termination confirmed for \n2026-03-12 03:01:43,380 [root] DEBUG: 1732: Terminate Event: monitor shutdown complete for process 1732\n2026-03-12 03:01:43,380 [root] INFO: Terminate event set for process 1732\n2026-03-12 03:01:43,396 [lib.api.process] INFO: Terminate event set for \n2026-03-12 03:01:43,396 [root] DEBUG: 3040: Terminate Event: Attempting to dump process 3040\n2026-03-12 03:01:43,411 [root] DEBUG: 3040: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching\n2026-03-12 03:01:43,427 [root] DEBUG: 3040: DoProcessDump: Code modification detected, dumping Imagebase at 0x00B20000.\n2026-03-12 03:01:43,427 [root] DEBUG: 3040: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-03-12 03:01:43,442 [root] DEBUG: 3040: DumpProcess: Instantiating PeParser with address: 0x00B20000.\n2026-03-12 03:01:43,442 [root] DEBUG: 3040: DumpProcess: Module entry point VA is 0x00B36B20.\n2026-03-12 03:01:43,567 [lib.common.results] INFO: Uploading file C:\\JRAvHIbPg\\CAPE\\3040_213204311012432026 to procdump\\97d270e310b9d835ae345e5abbc0a937242c2164f96f79f5dc6313f2f5deaa83; Size is 347648; Max size: 100000000\n2026-03-12 03:01:43,583 [root] DEBUG: 3040: DumpProcess: Module image dump success - dump size 0x54e00.\n2026-03-12 03:01:43,599 [lib.api.process] INFO: Termination confirmed for \n2026-03-12 03:01:43,599 [root] DEBUG: 3040: Terminate Event: monitor shutdown complete for process 3040\n2026-03-12 03:01:43,599 [root] INFO: Terminate event set for process 3040\n2026-03-12 03:01:43,614 [root] INFO: Created shutdown mutex\n2026-03-12 03:01:44,630 [root] INFO: Shutting down package\n2026-03-12 03:01:44,630 [root] INFO: Stopping auxiliary modules\n2026-03-12 03:01:44,630 [root] INFO: Stopping auxiliary module: Browser\n2026-03-12 03:01:44,630 [root] INFO: Stopping auxiliary module: Human\n2026-03-12 03:01:44,958 [root] INFO: Stopping auxiliary module: Screenshots\n2026-03-12 03:01:44,958 [root] INFO: Finishing auxiliary modules\n2026-03-12 03:01:44,958 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-03-12 03:01:46,771 [root] WARNING: Folder at path \"C:\\JRAvHIbPg\\debugger\" does not exist, skipping\n2026-03-12 03:01:46,849 [root] WARNING: Folder at path \"C:\\JRAvHIbPg\\tlsdump\" does not exist, skipping\n2026-03-12 03:01:46,974 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "1e7bd5767d36db15bb11fd0d03187a064737dd7483818d6bb34570e8233e6333", "hosts": [], "domains": [], "tcp": [], "udp": [ { "src": "192.168.55.100", "sport": 63613, "dst": "192.168.55.1", "dport": 53, "offset": 24, "time": 0.0 } ], "icmp": [], "http": [], "dns": [], "smtp": [], "irc": [], "dead_hosts": [ [ "20.42.65.90", 443 ], [ "192.168.55.100", 49738 ] ] }, "url_analysis": {}, "procmemory": [], "signatures": [ { "name": "queries_locale_api", "description": "Queries the computer locale (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 1732, "cid": 75 }, { "type": "call", "pid": 3040, "cid": 79 }, { "type": "call", "pid": 1532, "cid": 38 } ], "new_data": [], "alert": false, "families": [] }, { "name": "antivm_network_adapters", "description": "Checks adapter addresses which can be used to detect virtual network interfaces", "categories": [ "anti-vm" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "type": "call", "pid": 1532, "cid": 86 } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_timeout", "description": "Possible date expiration check, exits too soon after checking local time", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "process": "ipconfig.exe, PID 1532" }, { "type": "call", "pid": 1532, "cid": 391 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "new_data": [], "alert": false, "families": [] }, { "name": "uses_windows_utilities", "description": "Uses Windows utilities for basic functionality", "categories": [ "command", "lateral" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "command": "C:\\Windows\\system32\\cmd.exe /K \"C:\\Users\\malware\\AppData\\Local\\Temp\\test_win.bat\"" }, { "command": "ipconfig" } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 2.2, "ttps": [ { "signature": "uses_windows_utilities", "ttps": [ "T1202" ], "mbcs": [ "OB0009", "E1203.m06" ] } ], "malstatus": null }