adcb6cff93c756408287a2bac8e9c42d26c48cc9d4669fd9b29f1e9a5a1d86f4.exe
Process injection and evasion APIs
Dynamically resolved process-hollowing API chainRemote loader redirects thread context
SHA-256adcb6cff93c756408287a2bac8e9c42d26c48cc9d4669fd9b29f1e9a5a1d86f4
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x4003e5ba600bc4bce6270809a6f35223a53>[...K.bp..o5":S
0x410cc7e665a446cbdd60d45ba9de200e4d6.~fZDl...E......
0x420172ca2d0872d4bb4a0525a036a2c5830.,...-K..RZ.j,X0
0x43017ad925ec1d1b7275819379b2a0ee244...^...'X.7.*..D
0x4402e046139c8e4cda8a8041abfc4899073..a9...........s
0x450e1a9efeacbb46de267aed1d7d2f17176......m.g.....qv
0x460abcaffbdf1ac7c7cf6f490a067d67047......||....g.pG
0x47059d1d59384713ed52f1de896be78fc30Y....q>./....x.0
0x48029468ae3388c052e45843fd8af70d9c4)F..8...E.?..p..
0x490a58e5a9ddf3c4a7f75b5b39f9300c370..Z..<J.u......p
0x4a069f11377e2da83bab9f824419410e46fi..w......$A...o
0x4b00b6eff06fa938559229af9e16f904c38.n.....Y"...o.L8
0x4c03e8fe2684d334626a03f863859772687>..hM3F&.?.8Yw&.
0x4d09d6d3791b6820655b718bd9ef8203e62.m7....U..... >b
0x4e0c07a69d3cf9db7d28decc07054dcba57.zi........pT..W
0x4f058c4f6245bb2f8ef53bdf9e2ea22c0c8X..$[...S...."..
0x500e51e72d349df7f70341b5ecb8569bb06..r.I..p4.^..i..
0x510cc938c067b7f6e59bb17bf49aa65af37....{.nY...I.e.7
0x520e2af118267586b61ba95b1be3407327e....gXka....4.2~
0x530065580f5048ee8d9d0bc5acce8ba862d.U........Z....-
0x54047589a153d74f389458a60935ec13a28GX..=t..E.`.^.:(
0x55021d52d69b2a3141d2a3b8faa3d6e1e37!.-i....*;..=n.7
0x560766b87e6b9a6493195a1b4e143da3f95vk....I1....C.?.
0x570bff991fc8fee98d4c3f609d230d08c3a............0..:
0x580b0dcb0e054f18d76671f22717716516d....T..vg."qw.Qm
0x5906dce3730b7970d3f7dfcd02c58426529m.70...?}..,XBe)
0x5a00df5929a6fa8a0c3885c4d953fafa279....o....\M.?..y
0x5b0ff6c4f2f60bb592040533ac20c618e38.lO/`.Y @S:..a.8
0x5c05e6c027bc5893ccc26e376d563f34744^l.{..<.&.v.c.GD
0x5d04a2881fc187272ef72c2073cbb17be86J(...rr.r..<....
0x5e0612c7f72de8590aeef04bbe55642c656a,.r........VB.V
0x5f07f45d112af75f73a4ae884512584925c.E...u.:J..Q%..\
0x6001570a9ce273f32fbd45d3c3d803def02.p..'?2..]<=.=..
0x6108484e3d26deed5c685df7e1a7f07eabd....m.....~.....
0x620d5da176363bd95db48f38438b05304ba...cc...H..8.S..
0x6408b9e5547a890285b08b691e5797bf173..UG..([....y{.s
0x650f07a2892d747be1aa18c315ff4b305f7.z(..G....1_....
0x6609be5653a32b19fb83b3275e507123337..e:2...;2u...37
0x6707b234073180135f6e2a62a13f3f92d96{#@s..5...*...-.
⋯3 more rows
0x61ff00405060708090a0b0c0d0a0b0c0d0e0f................
0x6200000010203060708090a0b0c0d0c0d0e0f................
0x620100203060708090a0b0c0d0a0b0c0d0e0f................
0x620200001060708090a0b0c0d0a0b0c0d0e0f................
0x62030060708090a0b0c0d08090a0b0c0d0e0f................
0x6204000010203040508090a0b0c0d0c0d0e0f................
0x620500203040508090a0b0c0d0a0b0c0d0e0f................
0x620600001040508090a0b0c0d0a0b0c0d0e0f................
0x62070040508090a0b0c0d08090a0b0c0d0e0f................
0x620800001020308090a0b0c0d0a0b0c0d0e0f................
0x62090020308090a0b0c0d08090a0b0c0d0e0f................
0x620a0000108090a0b0c0d08090a0b0c0d0e0f................
0x620b008090a0b0c0d060708090a0b0c0d0e0f................
0x620c000010203040506070a0b0c0d0c0d0e0f................
0x620d00203040506070a0b0c0d0a0b0c0d0e0f................
0x620e00001040506070a0b0c0d0a0b0c0d0e0f................
0x620f0040506070a0b0c0d08090a0b0c0d0e0f................
0x621000001020306070a0b0c0d0a0b0c0d0e0f................
0x62110020306070a0b0c0d08090a0b0c0d0e0f................
0x62120000106070a0b0c0d08090a0b0c0d0e0f................
0x6213006070a0b0c0d060708090a0b0c0d0e0f................
0x621400001020304050a0b0c0d0a0b0c0d0e0f................
0x62150020304050a0b0c0d08090a0b0c0d0e0f................
0x62160000104050a0b0c0d08090a0b0c0d0e0f................
0x6217004050a0b0c0d060708090a0b0c0d0e0f................
0x62180000102030a0b0c0d08090a0b0c0d0e0f................
0x6219002030a0b0c0d060708090a0b0c0d0e0f................
0x621a000010a0b0c0d060708090a0b0c0d0e0f................
0x621b00a0b0c0d0405060708090a0b0c0d0e0f................
0x621c0000102030405060708090c0d0c0d0e0f................
0x621d002030405060708090c0d0a0b0c0d0e0f................
0x621e000010405060708090c0d0a0b0c0d0e0f................
0x621f00405060708090c0d08090a0b0c0d0e0f................
0x6220000010203060708090c0d0a0b0c0d0e0f................
0x622100203060708090c0d08090a0b0c0d0e0f................
0x622200001060708090c0d08090a0b0c0d0e0f................
0x62230060708090c0d060708090a0b0c0d0e0f................
0x6224000010203040508090c0d0a0b0c0d0e0f................
0x622500203040508090c0d08090a0b0c0d0e0f................
0x622600001040508090c0d08090a0b0c0d0e0f................
0x62270040508090c0d060708090a0b0c0d0e0f................
0x622800001020308090c0d08090a0b0c0d0e0f................
0x62290020308090c0d060708090a0b0c0d0e0f................
0x622a0000108090c0d060708090a0b0c0d0e0f................
0x622b008090c0d0405060708090a0b0c0d0e0f................
⋯3 more rows
0x64420705c064001000000b05c064001000000p\.@.....\.@....
0x644306100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x6444069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x644506600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x6446031002d0031002d0031000000000000001.-.1.-.1.......
0x644706100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x6448069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x64490730079006e00630068002d006c003100s.y.n.c.h.-.l.1.
0x644a02d0032002d0030000000000000000000-.2.-.0.........
0x644b06b00650072006e0065006c0033003200k.e.r.n.e.l.3.2.
0x644c000000000000000006100700069002d00........a.p.i.-.
0x644d06d0073002d0000000000000002000000m.s.-...........
⋯7 more rows
⋯3 more rows
0x6538890990800300000000000000005000000....0...........
0x653986d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x653a864006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows
⋯3 more rows
0x897988b014765744d65737361676557002803..GetMessageW.(.
0x897a8536574436c6970626f61726444617461SetClipboardData
0x897b800003601476574436c6970626f617264..6.GetClipboard
0x897c8446174610000e800456d707479436c69Data....EmptyCli
0x897d870626f61726400004f00436c6f736543pboard..O.CloseC
0x897e86c6970626f61726400009c024f70656elipboard....Open
0x897f8436c6970626f61726400420147657443Clipboard.B.GetC
0x898087572736f72506f7300002e0353657443ursorPos....SetC
⋯17 more rows
0x8992874696f6e4a6f624f626a656374005406tionJobObject.T.
0x89938577269746550726f636573734d656d6fWriteProcessMemo
0x89948727900004901456e7465724372697469ry..I.EnterCriti
0x8995863616c53656374696f6e000032024765calSection..2.Ge
⋯7 more rows
0x899d8437269746963616c53656374696f6e00CriticalSection.
0x899e84303476574566f6c756d65496e666f72C.GetVolumeInfor
0x899f86d6174696f6e4100100657616974466fmationA...WaitFo
0x89a087253696e676c654f626a65637400f304rSingleObject...
0x89a18526573756d6554687265616400009202ResumeThread....
0x89a284765744d6f64756c6548616e646c6541GetModuleHandleA
⋯3 more rows