Skip to content

Instantly share code, notes, and snippets.

@hasherezade

hasherezade/ldr.dll.tag Secret

Created October 23, 2021 20:51
Star
Embed
What would you like to do?
Learn more about clone URLs
Download ZIP
FlareOn 8 - Task 7: trace log 2 (after renaming the loader to Spell.EXE)
Raw
ldr.dll.tag
3750;section: [.text]
4118;CPUID:0
4176;CPUID:1
4211;CPUID:7
4bb0;kernel32.LoadLibraryExW
4c47;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e3e8 -> "InitializeCriticalSectionEx"
4e83;kernelbase.InitializeCriticalSectionEx
4bb0;kernel32.LoadLibraryExW
4c47;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e390 -> "FlsAlloc"
4d0b;kernelbase.FlsAlloc
4c47;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e3d0 -> "FlsSetValue"
4e10;kernelbase.FlsSetValue
7424;kernel32.LoadLibraryExW
74aa;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e3e8 -> "InitializeCriticalSectionEx"
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
8c00;kernel32.GetProcessHeap
7424;kernel32.LoadLibraryExW
74aa;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e390 -> "FlsAlloc"
7568;kernelbase.FlsAlloc
7123;kernel32.GetLastError
74aa;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e3b8 -> "FlsGetValue"
7616;kernelbase.FlsGetValue
6815;ntdll.RtlAllocateHeap
74aa;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd3130e3d0 -> "FlsSetValue"
7679;kernelbase.FlsSetValue
732a;ntdll.RtlEnterCriticalSection
737e;ntdll.RtlLeaveCriticalSection
732a;ntdll.RtlEnterCriticalSection
737e;ntdll.RtlLeaveCriticalSection
7197;kernel32.SetLastError
732a;ntdll.RtlEnterCriticalSection
732a;ntdll.RtlEnterCriticalSection
6815;ntdll.RtlAllocateHeap
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
737e;ntdll.RtlLeaveCriticalSection
8c44;kernel32.GetStartupInfoW
8d82;kernel32.GetStdHandle
8d98;kernel32.GetFileType
8d82;kernel32.GetStdHandle
8d98;kernel32.GetFileType
8d82;kernel32.GetStdHandle
8d98;kernel32.GetFileType
737e;ntdll.RtlLeaveCriticalSection
8a34;kernel32.GetCommandLineA
8a41;kernel32.GetCommandLineW
708a;kernel32.GetLastError
7616;kernelbase.FlsGetValue
70f2;kernel32.SetLastError
708a;kernel32.GetLastError
7616;kernelbase.FlsGetValue
70f2;kernel32.SetLastError
732a;ntdll.RtlEnterCriticalSection
737e;ntdll.RtlLeaveCriticalSection
81a9;kernel32.GetACP
66e6;ntdll.RtlAllocateHeap
8776;kernel32.IsValidCodePage
878b;kernel32.GetCPInfo
82ae;kernel32.GetCPInfo
9753;kernel32.MultiByteToWideChar
981c;kernel32.MultiByteToWideChar
9836;kernel32.GetStringTypeW
a663;kernel32.MultiByteToWideChar
a728;kernel32.MultiByteToWideChar
7424;kernel32.LoadLibraryExW
74aa;kernel32.GetProcAddress
Arg[0] = ptr 0x00007ffd42590000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ffd313102f0 -> "LCMapStringEx"
77ae;kernelbase.LCMapStringEx
77ae;kernelbase.LCMapStringEx
a8b8;kernel32.WideCharToMultiByte
a663;kernel32.MultiByteToWideChar
a728;kernel32.MultiByteToWideChar
77ae;kernelbase.LCMapStringEx
77ae;kernelbase.LCMapStringEx
a8b8;kernel32.WideCharToMultiByte
732a;ntdll.RtlEnterCriticalSection
737e;ntdll.RtlLeaveCriticalSection
732a;ntdll.RtlEnterCriticalSection
66e6;ntdll.RtlAllocateHeap
737e;ntdll.RtlLeaveCriticalSection
3ebb;ntdll.RtlInitializeSListHead
732a;ntdll.RtlEnterCriticalSection
737e;ntdll.RtlLeaveCriticalSection
6815;ntdll.RtlAllocateHeap
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
76ec;kernelbase.InitializeCriticalSectionEx
c579;CPUID:1
5ccf;kernel32.GetModuleFileNameA
6815;ntdll.RtlAllocateHeap
8a71;kernel32.GetEnvironmentStringsW
8ad3;kernel32.WideCharToMultiByte
66e6;ntdll.RtlAllocateHeap
8b0d;kernel32.WideCharToMultiByte
8b37;kernel32.FreeEnvironmentStringsW
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
6815;ntdll.RtlAllocateHeap
667e;kernel32.HeapFree
36f8;ntdll.[RtlActivateActivationContextUnsafeFast+114]*
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
66e6;ntdll.RtlAllocateHeap
19c7;kernel32.VirtualAlloc
1a8e;kernel32.VirtualAlloc
1b4d;kernel32.GetModuleFileNameA
1b63;kernel32.GetModuleHandleA
1ba8;kernel32.FindResourceA
Arg[0] = ptr 0x00007ff6ebae0000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = 0x0000000000000080 = 128
Arg[2] = ptr 0x000000c0948efa54 -> "PNG"
1bc5;kernel32.SizeofResource
Arg[0] = ptr 0x00007ff6ebae0000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00007ff6ebae6080 -> {\xb0`\x00\x00\xd6\x00\x00\x00}
1be2;kernel32.LoadResource
1bfc;kernel32.LockResource
1dfb;kernel32.GetCurrentProcess
1e1c;kernel32.IsWow64Process
2daf;kernel32.GetSystemTime
2e47;kernel32.GetDateFormatW
2eb5;kernel32.lstrlenA
1a1e;kernel32.SleepEx
Arg[0] = 0x0000000000057e40 = 360000
Arg[1] = 0
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff296c5c00 -> fffffffffffe7960
1c3a;kernel32.VirtualAlloc
1318;kernel32.GetModuleHandleA
1339;kernel32.LoadLibraryA
Arg[0] = ptr 0x000000c094952400 -> "ws2_32.dll"
1fc4;ws2_32.WSAStartup
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
1339;kernel32.LoadLibraryA
Arg[0] = ptr 0x000000c0949522e0 -> "user32.dll"
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
1318;kernel32.GetModuleHandleA
2162;ws2_32.closesocket
2035;kernel32.Sleep
NtDelayExecution hooked. Overwriting DelayInterval: ffffffff4d2fa200 -> fffffffffffe7960
1318;kernel32.GetModuleHandleA
20b8;ws2_32.socket
1318;kernel32.GetModuleHandleA
2d6c;user32.wvsprintfA
1318;kernel32.GetModuleHandleA
2146;ws2_32.gethostbyname
1318;kernel32.GetModuleHandleA
21ba;ws2_32.ntohs
1318;kernel32.GetModuleHandleA
21df;ws2_32.connect
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment