Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 13, 2021, 3:59 p.m.	May 13, 2021, 4:01 p.m.

Size	1.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a0b256269745ce17a7782647a66c9428`
SHA256	`882196c359dfed7c00f4ccb613226744a391e63e37db80336ffe8657a8dea280`
CRC32	`A818EDB6`
ssdeep	`49152:LP2hOzf/iD5fUXciiD8NY+bt6Aw4lFoYXbja9FUsX60i:T2hWscXciiQC+bt6AwihkCW60i`
PDB Path	wextract.pdb
Yara	PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)

easyon-1.exe "C:\Users\test22\AppData\Local\Temp\easyon-1.exe"
112
- ClientRun.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ClientRun.exe
  2260
  - SeetrolClient.exe "C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"
    2256
    - ipconfig.exe "C:\Windows\System32\ipconfig.exe" /flushdns
      2044
    - Seetrol_Clt.exe "C:\Program Files (x86)\seetrol\client\Seetrol_Clt.exe" -controlservice -slave
      2032

Name	Response	Post-Analysis Lookup
www.seetrol.com	A 45.115.155.209	45.115.155.209
easyon.seetrol.com	A 1.209.106.212	1.209.106.212

IP Address	Status	Action
1.209.106.212	Active	Moloch
164.124.101.2	Active	Moloch
45.115.155.209	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 45.115.155.209:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected
TCP 45.115.155.209:80 -> 192.168.56.101:49203	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.115.155.209:80 -> 192.168.56.101:49202	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.101:49203 -> 45.115.155.209:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected
TCP 45.115.155.209:80 -> 192.168.56.101:49203	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	A Network Trojan was detected
TCP 45.115.155.209:80 -> 192.168.56.101:49203	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	A Network Trojan was detected
TCP 45.115.155.209:80 -> 192.168.56.101:49203	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 13, 2021, 3:59 p.m.			0	0
IsDebuggerPresent May 13, 2021, 3:59 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 13, 2021, 3:59 p.m.	buffer: Windows IP Configuration console_handle: 0x00000007	1	1	0
WriteConsoleW May 13, 2021, 3:59 p.m.	buffer: Successfully flushed the DNS Resolver Cache. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 13, 2021, 3:59 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

Performs some HTTP requests (16 events)

request	GET http://www.seetrol.com/update3/SeetrolCenter.exe
request	GET http://www.seetrol.com/update3/NetScan.exe
request	GET http://www.seetrol.com/update3/MirrInst32.exe
request	GET http://www.seetrol.com/update3/MirrInst64.exe
request	GET http://www.seetrol.com/update3/Install.txt
request	GET http://www.seetrol.com/update3/Uninstall.txt
request	GET http://www.seetrol.com/update3/068/dfmirage.cat
request	GET http://www.seetrol.com/update3/068/dfmirage.dll
request	GET http://www.seetrol.com/update3/068/dfmirage.inf
request	GET http://www.seetrol.com/update3/068/dfmirage.sys
request	GET http://www.seetrol.com/update3/105/dfmirage.cat
request	GET http://www.seetrol.com/update3/105/dfmirage.inf
request	GET http://www.seetrol.com/update3/105/x64/dfmirage.dll
request	GET http://www.seetrol.com/update3/105/x64/dfmirage.sys
request	GET http://www.seetrol.com/update3/105/x86/dfmirage.dll
request	GET http://www.seetrol.com/update3/105/x86/dfmirage.sys

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72904000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72942000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73744000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72942000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x067e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72411000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72041000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x723e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73744000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 13, 2021, 3:59 p.m.	process_identifier: 2032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72942000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

Seetrol_Clt.exe tried to sleep 222 seconds, actually delayed analysis time by 222 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW May 13, 2021, 3:59 p.m.	number_of_free_clusters: 3351265 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW May 13, 2021, 3:59 p.m.	number_of_free_clusters: 3351265 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Foreign language identified in PE resource (17 events)

name

AVI

language

LANG_KOREAN

filetype

RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp

sublanguage

SUBLANG_KOREAN

offset

0x0000d7e8

size

0x00002e1a

name

RT_ICON

language

LANG_KOREAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_KOREAN

offset

0x000108ec

size

0x00000128

name

RT_ICON

language

LANG_KOREAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_KOREAN

offset

0x000108ec

size

0x00000128

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_GROUP_ICON

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x001ce36c

size

0x00000022

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x001ce390

size

0x00000440

Creates executable files on the filesystem (17 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\STClientChat.exe
file	C:\Program Files (x86)\seetrol\client\MirrInst32.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ClientRun.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\sas.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Seetrol_Clt.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\STUpdate.exe
file	C:\Program Files (x86)\seetrol\client\Install.cmd
file	C:\Program Files (x86)\seetrol\client\068\dfmirage.dll
file	C:\Program Files (x86)\seetrol\client\SeetrolCenter.exe
file	C:\Program Files (x86)\seetrol\client\105\x86\dfmirage.dll
file	C:\Program Files (x86)\seetrol\client\105\x64\dfmirage.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\SeetrolMyService.exe
file	C:\Program Files (x86)\seetrol\client\Uninstall.cmd
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\sthooks.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\SeetrolClient.exe
file	C:\Program Files (x86)\seetrol\client\MirrInst64.exe
file	C:\Program Files (x86)\seetrol\client\NetScan.exe

Creates a service (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 13, 2021, 3:59 p.m.	service_start_name: start_type: 2 password: display_name: SeetrolClient Service filepath: C:\Program Files (x86)\seetrol\client\"C:\Program Files (x86)\seetrol\client\Seetrol_Clt.exe" -service service_name: SeetrolClientService filepath_r: "C:\Program Files (x86)\seetrol\client\Seetrol_Clt.exe" -service desired_access: 983551 service_handle: 0x01188dd0 error_control: 1 service_type: 16 service_manager_handle: 0x01188e20	1	18386384	0
CreateServiceW May 13, 2021, 3:59 p.m.	service_start_name: start_type: 2 password: display_name: SeetrolMy Service filepath: C:\Program Files (x86)\seetrol\client\"C:\Program Files (x86)\seetrol\client\SeetrolMyService.exe" service_name: SeetrolMyService filepath_r: "C:\Program Files (x86)\seetrol\client\SeetrolMyService.exe" desired_access: 983551 service_handle: 0x01188e48 error_control: 1 service_type: 272 service_manager_handle: 0x01188e20	1	18386504	0

A process created a hidden window (27 events)

Time & API	Arguments	Status	Return
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: ipconfig.exe parameters: /flushdns filepath: ipconfig.exe	1	1
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 3:59 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0
ShellExecuteExW May 13, 2021, 4:01 p.m.	show_type: 0 filepath_r: NetScan.exe parameters: filepath: NetScan.exe		0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 events)

Time & API	Arguments	Status	Return
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000114 process_name: pw.exe process_identifier: 1552	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000114 process_name: taskhost.exe process_identifier: 3020	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000114 process_name: sdclt.exe process_identifier: 2420	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000114 process_name: easyon-1.exe process_identifier: 112	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000114 process_name: ClientRun.exe process_identifier: 2260	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000574 process_name: SeetrolClient.exe process_identifier: 2256	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000580 process_name: Seetrol_Clt.exe process_identifier: 2196	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000580 process_name: Seetrol_Clt.exe process_identifier: 2032	1	1
Process32NextW May 13, 2021, 3:59 p.m.	snapshot_handle: 0x00000580 process_name: SeetrolMyService.exe process_identifier: 3056	1	1

An executable file was downloaded by the process seetrolclient.exe (9 events)

Time & API	Arguments	Status	Return
recv May 13, 2021, 3:59 p.m.	buffer: HTTP/1.1 200 OK Date: Thu, 13 May 2021 06:59:47 GMT Server: Microsoft-IIS/5.0 Last-Modified: Wed, 11 Jan 2017 00:39:28 GMT ETag: "9f658-235e8-545c6d54d3000" Accept-Ranges: bytes Content-Length: 144872 Keep-Alive: timeout=10, max=99 Connection: Keep-Alive Content-Type: application/octet-stream MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $»Ðÿ±oÝÿ±oÝÿ±oÝØwÝõ±oÝØwÝâ±oÝÿ±nÝÎ³oÝöÉúÝä±oÝöÉìÝr±oÝáãëÝü±oÝöÉëÝ_±oÝáãûÝþ±oÝöÉþÝþ±oÝRichÿ±oÝPELÑ JXà P00@@`ü¤R@¤è2HÜ=@UPX0 àUPX10@à.rsrc @@À received: 1024 socket: 956	1	1024
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $XÌKi¢i¢i¢;&'i¢;7i¢;!fi¢;¯Ïi¢;¯Ùi¢i£i¢;(i¢;6i¢;3i¢Richi¢PEL&æ³Hà B8`@0Ã4ÖP ¨àøPbÀÉ@`ø.text´@B `.rdatan`F@@.data /ðÈ@À.rsrc¨ Ú@@Pÿ@!QPÒt ëHÃVqpA^; uHÉtÿBÃ¸OAè>QQSVW3ÿ}ìñ}ðWWEðPW}üÿvWhÿô`A;Çt+Mðøvf\|Aü u f\|Aþ uHHQøuìè¶ÆEüë+¡ B¹ BÿPÀEìÆEüÿvEìh\|APè7Ä]Eìè¡Eìèùÿuðÿì`AMô_^Ã[d ÉÂÿ6ÿì`A&ÃVñÉtjÿ&^ÃUìQjèÑ_YÀtMH`Ç¬\|Aë3ÀEühÒAEüPèÌwÌ\|$uÿt hWèµÿÿÿ¡ BjW¹ BÿÀuèÔÀÇÖè¹ÿt$ÇWÿ6èÃÄÆÂUì}VWðu hWèbÿÿÿÿuÿuèï_YYøWèÿuOÿuQPètaÄÇÖè[_^]ÂÁL$!ÂD$Pÿt$D$èÿÿÿÃ¸ZOAèF<¡ BVu¹ BÿPÀ3ÀEü;øt÷Çÿÿu·ÇPVè#ëWèaYPWÆèMôÆ^d ÉÂSUVW3ÿ»8 BWËèI;3íEë:ÿu<D$Áè@W·ÀPjVÿØ`AÀtPD$Vè7øYYÿuUËè;EðöuÀ3ööu3Àëÿt$Vÿt$è_^][ÂUìEÁèW@·ÀjPÿuÿÜ`AÀtPÿuEè×øYYÿu3ÀëIS·VuSèð·ÇøÿuWè0`Y@ÀPWPVèp\PègUÄÃèã3À^@[_]ÂUì}VðuèêëeW}ÿu hWèýÿÿSÿuXô+øÑÿè6;û[wMÉQxQIøÉQPèÉ_ÄëÿuÿqøPEèÄEÖèb_^]ÂVÿt$ðÿt$ÿà`AÀu^ÃWPÿä`Aøÿt'ÿt$ÿt$ÿè`AÇæv;øsN·\|Ouò;ør3Àë ·÷ØÀ#Ç_^ÃÀ\| ;AøAô 3ÒfAÃhWèµüÿÿÌAðxW8tEP:}yø} hWèüÿÿaô3Éf_ÃÉÿðÁ IÉPÿRÏÿPÀ_ÃD$Àt,øt øtø"tøPth@è9üÿÿhWëôhëíÃUìESV0^ôîWÿPjÿuÈÿøÿuè3E;Ø}ÃVR@OPQMè#Ä_FÉÿðÁIÉVÿPEM_^[]Âè9P}Ò~W9jRPÿW_ÀuèÈÀÃVñWøHôè;Ï~ùx~ WVè@ÿÿÿë#@;Ç}Ð¸;Ð~ÐëÒ;×}×èÿÿÿ_^Ã3ÉèA+H@+D$È}D$ÎèÿÿÿÂVñèöD$tVè YYÆ^ÂVñÇ¬\|ANÉtjÿf^ÃÉu h@èÖúÿÿÿPÀÆÃhè¿úÿÿÌÀPÿt$D$ÀPÿt$èKYÄÃV0îWÿPV:\|;u3Àþ@ðÁë1jÿvÈÿøÿuèÿÿÿFGFÆ@VPOQèÿÿÿÄÇ;_Ã^ÃèHÊÿðÁJÒPÿRÃéÞÿÿÿUìVWø·÷Áï}àSº°9UsU)UúÂÁèØkÛðÓ¾ó¾Yþó¾Yþó¾Yþó¾Yþó¾Yþó¾Yþó¾Yþó¾Yþó¾Y þó¾Y þó¾Yþó¾Yþó¾Y þó¾Yþó¾YþóþÁHwÿÿÿÒt¾ðAþJuõÆ3Ò»ñÿó÷öÇò3Ò÷ó}ú"ÿÿÿ[ÇÁà_Æ^]ÃUìì4SVWÿu»Ä}Aÿu¿P}Ah`}ASEôÇEô N}øÇEü è¿Ä¾VÐûÿÿPjÿÈ`AÀuÿÄ`AVØýÿÿPhÌ}AÿÀ`AØýÿÿhä}APè§\ØýÿÿPhð}ASEôÇEô N}øÇEü+èSÄjØýÿÿPÿ¼`AÀÿÄ`AÀ~ %ÿÿ Eð=·t}PØýÿÿPh0~ASEôÇEô0u}øÇEü6èôÄ}ð}MVØýÿÿPhÌ}AÿÀ`AØýÿÿh~APèõ[ØýÿÿPh ~ASEôÇEô N}øÇEü?è¡ÄØýÿÿPPèÍØýÿÿPhASEôÇEô N}øÇEüDèkÄ3öVØýÿÿPÐûÿÿPÿ¸`AÀuNÿÄ`A;Æ~ %ÿÿ ðVØýÿÿPÐûÿÿPh0ASEôÇEô@}øÇEüNè ÄÆé>ØýÿÿPèÏS;ÆY}#PhASEôÇEô0u}øÇEüWèÎÄ¿AWØýÿÿPEüPèÒ÷ÿÿMðQÈènYYMìQÈèaYYEðèuüÿÿEüèmüÿÿ9utIÿuè÷XYÀt<ÿuEðP¿Aè÷ÿÿMüQÈè!YYÿpôPEìèÊEüè'üÿÿEðèüÿÿuøuühAuøè/uìötVÿ´`ADPVjjÿuÿuøÿX`AÿuìEàÿuÇEà NhtASÇEäP}AÇEègèÝÄ}øt ÿuøÿ``AEìè¥ûÿÿ3À_^[ÉÃUìì(SVWÿu¿Ä}Ah¬A»P}AWEäÇEä N]èÇEìnèeèeìÄhAuèèqÿuÿuèÿT`AÀt&PÿuEðhèAWÇEð N]ôÇEøè9ÄhÜýÿÿPjÿÈ`A5Ä`AÀuÿÖÜýÿÿPh@AWEðÇEð N]ôÇEøèð request_handle: 0x00cc0010	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $Äe[ò5¡5¡5¡V±¡¼5¡V¶¡õ5¡V ¡5¡§ÂX¡5¡§ÂN¡5¡4¡5¡V¿¡5¡V¡¡5¡V¤¡5¡Rich5¡PEdæ³Hð# Ô¸¬@ÀìP5P°¨øZø ¤ .text `.rdataò¢ ¤@@.data8;P@À.pdataøB@@.rsrc¨°T@@LÜSUVWATHìPHÇD$@þÿÿÿHêHÙE3äD¤$McMc¸Ec°ICIC¨E3ÉDA3Ò¹ÿøA;ÄÜH´$ED$A;ÀvPþf<V uHÿf<N DúI;ôuA;üt¹WèoÌ×H !UHUÿI;ÄuèzÌHXH$A;ü\|g;{ôb{ðHcÇHfD$LÊLÆHËè¢H$HÍèEHSèÈÿðÁBÿÈA;Ä H HÿPH$ÿµHÅé¹WèÏÌH TH\|TÿPHÀH$DCH ±H$èH$HÍèÁH$HÂèÈÿðÁBÿÈA;Ä H HÿPH$ÿ)HÅHÄPA\_^][ÃÌÌÌ@SHì HÙH ÿH#HÄ [Ã@SHì HÙH HÉt HºÿH#HÄ [ÃÌÌÌ@SHì Ù¹èÖHÀtH v°XH`Hë3ÀHø"HL$8HD$8èõ ÌHÄHXHhHpHx ATHì E3äIèHòHùI;Ôu¹WèÿÿÿÌIÐHÎè\Hº+QøIôHcØ+ËÑ} ÓHÏèÛHCLÍHcÐLÆèëA;Ü\|.H;Xô&Hl$8Ht$@XðHH\|$HfD$XH\$0HÄ A\Ã¹Wè ÿÿÿÌÌHÄHPL@LH Hì(L@è0ÿÿÿHÄ(ÃÌÌÌHL$WHì0HÇD$ þÿÿÿH\$HHÚHùH {RHtRÿPHÀHHÛt H÷Ãÿÿu ·ÓHÏè-ëHËèGë3ÀDÀHÓHÏèÑHÇH\$HHÄ0_ÃÌÌHÄHXHhHpHx ATAUAVHì LéDâH Jc3Ò3ÛèoDsAîé§HÛªAÄSE3ÉÁèHÎfAÆD·Àÿ¯HØHÀthHÐHÎÿ«HÀu3ÛëNHÈÿ¡HøHÀtëHÓHÎÿAÌDØLßávI;ûsÌÁÿ·H\|GuîI;ûsº·f÷ØHÛH#ßHÛuH bÕèinAîHðHÀMÿÿÿ3öHöu3ÀëEÄHÖIÍè!H\$@Hl$HHt$PH\|$XHÄ A^A]A\ÃÌÌHÄHXHhHpHx ATAUAVHì AÀHêA¾ÁèAøHñfAÆEFHÍ·ÐÿªE3íLàI;ÅHÐHÍÿI;ÅHÈÿHØI;ÅòIÔHÍÿ}DØLÛçvI;ÛÒÇÿ·H\CuêI;Û¼fD9+²H·;AÎ+Hø@ô+ÇÈ} ×HÎèÞ·H.ùÿu HKèALcÉL$?LCIÔMÉHÍè±A;Åt5øt%øtø"tøPt!¹@è üÿÿÌ¹WèÿûÿÿÌ¹èôûÿÿÌA;ý\|H;yôyðHAÆfE,ë ¹WèÌûÿÿÌ3ÀH\$@Hl$HHt$PH\|$XHÄ A^A]A\ÃÌÌH\$Hl$Ht$WATAUHì IcøE3íHòHÙA;ýuuHHPèH:D9jt"D9j}5D9hô}¹WèYûÿÿÌDhðHfD(H\$@Hl$HHt$PHÄ A]A\_ÃÈÿðÁBÿÈA;Å H HÿPHHÏÿPHÀHë½I;Õu¹WèûúÿÿÌHHê¹+HøD`ðH+è@ôHÑý+ÇÈ} ×HËèOHHcQôHÒI;ìL$?MÌwLièëLÆèA;ý\|H;xôxðHfE,é<ÿÿÿ¹WèúÿÿÌÌÌHÄHXHhHpHx ATHì HHñúHKèDcðHÿP A¸×LHÈAÿHèHÀuèWÌD;çLÃALüÿÇHc×HxHÒHÏLÊè~DeÈÿðÁCøÿÈÀHKèHSèHÿPH\$0Hl$8H>Ht$@H\|$HHÄ A\ÃÌÌÌ@SHì DÂHHÙHêD9BH })EÀ~$HA¹ÿPHÀuè½ÌHÀHHÄ [ÃèªÌÌHì(ÂH9BðOBðzø~ Ðèçþÿÿë#Rô;Ð}A¸A;Ð~AÐëÒ;ÐLÐèrÿÿÿHÄ(ÃÌHH"HHÁÃÌÌH\$WHì H«©HÙúHHIHÉt HºÿHc@öÇtHËèe}HÃH\$0HÄ _ÃÌÌÌHì(¹èÊøÿÿÌÌH\$Ht$WHì HHñHKèHÿP {øHÈ\|H;CèuH{èðCøë<HSðA¸ÿHøHÀuèÿÿÿÌCðHOLÃGCðÿÀHcÐHÒLÊè×\|H\$0HGHHÆHt$8HÄ _ÃÌHì(HHêÈÿðÁBÿÈÀ H HÿPHÄ(ÃÌD·ÉLÒÁéé"º°D;ÂABÐD+ÂúÎDÚIÁëAÃ÷ØÁàÐA¾IÂDÈA¾BñAÉDÈA¾BòAÉDÈA¾BóAÉDÈA¾BôAÉDÈA¾BõAÉDÈA¾BöAÉDÈA¾B÷AÉDÈA¾BøAÉDÈA¾BùAÉDÈA¾BúAÉDÈA¾BûAÉDÈA¾BüAÉDÈA¾BýAÉDÈA¾BþAÉDÈA¾BÿAÉDÈAÉIëCÿÿÿÒtA¾IÿÂDÈAÉêuî¸qA÷á¸qÁêiÒÿÿDÊ÷áÁêiÒÿÿÊEÀÕþÿÿÁáAÉÁÃÌHÄHXVWATAUAVHì`HñLÉHúHT$ L5q¨L-î§Lÿ§HûÿÿA¼ NIÖL¨ûÿÿÇûÿÿ D ûÿÿèN$H$PA¸3ÉÿÜÀuÿÊH$@H ¨A¸ÿ§H¨H$@è·L$@L¨H$ request_handle: 0x00cc0014	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@Øº´ Í!¸LÍ!This program cannot be run in DOS mode. $Ð½vúÜ©Ü©Ü©ü©Ü©Íÿ©Ü©Ü©¶Ü©\|Ã©Ü©,Ú©Ü©RichÜ©PELëøCà!R àB` £p(è@`XÈ.textÎLN h.data<`R@ÈINITdpT â.rsrcèX@B.reloc\@B´pÈpÜpîpqq0qJqXqfqxqq q´qÊqàqúqr&r<rLrfrxrrr°rÆrÔrðrürs s6sXsëøC=`MIRAGECap.ExtraDfbSafetyDelayCap.DfbBackingModeScreen.ForcedBppPointer.Enabledÿÿÿÿ\&b&ÿÿÿÿ§((\(b(ÿÿÿÿ¸¾¤ÿÿÿÿx,~,^,d,ÿÿÿÿQ.W.7.=.ÿÿÿÿÔ/Ú/ÿÿÿÿ´0º0ÿÿÿÿ×1Ý1½1Ã1ÿÿÿÿ48:8ÿÿÿÿ8£8ÿÿÿÿ9$9ÿÿÿÿh:n:N:T:ÿÿÿÿ<<t<z<ÿÿÿÿ ??ï>õ>ÿÿÿÿÍ@Ó@³@¹@ÿÿÿÿ[EaEÿÿÿÿFFÿÿÿÿG GÿÿÿÿGGÿÿÿÿHHÿÿÿÿíHóHÿÿÿÿÝOãO¼System MS Sans Serif Courierÿÿÿÿ2T8TUìÁUM3ÉHHH H0H$H(H,HMPUH3ÉPHÁé¯HÁáüH]ÂVñèhvötVèE^ÃUììSVuÙWVMøèÙ}ùj4çÿÁï¯}Ççü¯}èèÄÀtMUVQRSÈè@ÿÿÿðöu_^3À[å]ÂEù%ÿÀøøw83Éÿ$\|ÇEëÇEëÇEëÇEËèçEUMRÀEPQVtèâDëèÕDÀFujÎè_^3À[å]ÂËè¥EKVäï +PQREFèDÀujÎèÙ_^3À[å]Â{8uIUCjjjVjRPFPèPDÀu _^[å]ÂFPè4DÀu _^[å]ÂPfÇ@0èDC8Àt-Cx~0Àt#KDQÎèsÀujÎèV_^3À[å]ÂSÎRèÀEÀt sÇF Æ_^[å]Â09BKYUìSVñW>ÏèoF$Àt_^¸[]Â]Ï^$èOøu.FNjPSVjQÏè5VPRè=CÀß_^[]ÂÏèø½Mè3ÀSFjPèÆNVPFQRPèCPMèMèÀuIjÏèÆPMèPèÏBÀuÏèMè4_^3À[]ÂMèPèBÀF,uÏèMè_^3À[]ÂMèFMF(èë_^¸[]ÂÏèHÀu _^¸[]ÂVñW>Ïè#øu+FjjjVÌjPÏèNPQèBÇF$_^ÃÏèìøu2F,ÀtPèàAF(ÇF,ÀtPèÆAÇF(ÇF$_^ÃÏè®ÇF$_^ÃUìSVW}ñWNèüÿhDrmDhjèAÀEFu_^[]ÂÈ2Ò2ÛÇF2À¿YAÆAÁÂ uÃ u@OuâM¸`º(`+Á+Ñ¿ ØÁOuìEjjjPhjë^SWèõÀtNVQRPjjjèAÀFu'3ÿNWè)F~;ÇtPèÙ@~_^3À[]Â_^¸[]ÂUìQSVWhDrmD3ÿhÙj}üè@ðöu _^[å]ÂUÒvCÀtbÒvKÆ+Î<8ÀJuõ}EMVWPQèt@;øu3×OÒtL¾GÆHéÀwõjjjVhjè8@ÀEüu}üVè@ÿtWè$@_^3À[å]ÂCÀtPè@CÇCÀtPèæ?Eüs_C^¸[å]ÂUìVñèåùÿÿöEt Vè9ÄÆ^]ÂUìEhDrmDPjèw?]ÃUìEPèd?]ÃUìEHøwE3Étÿ$X¸]Â¸]Â¸]Â¸]Â¸]Â¸]Â3À]Â$-6?HQUìÁM]ÂÁÇÃÀtPèÃUìEPèT>]Â3ÀÒÀÃUìVñÀtPèÎÿ request_handle: 0x00cc0024	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÅÌKÁ%%%%%$£%Ø6%i².%9«#%i²!%Rich%PELòøCà!L0À³¦IP @fX°ð .text( h.data´C0D@È.edataIZ@@INITª\ â.rsrc `@B.reloc°d@Búä2<XpªÂÐÚò(H\lz¦ºÖì2>Vf8òøC<fÿÿÿÿuÿÿÿÿ¾Îÿÿÿÿ+;ÔÂ°Âh0èÖÿÿÿ3ÀÂh0èÆÿÿÿ3ÀÂh(0è¶ÿÿÿ¸àÂUìE8pr\ °sÑAÒ °st ¸7]ÂS3ÛVuXXX X8X0X4@dÎPèÃèPÎè M^3À[]Â¸W]Â°ÂUìS]VW=à.#^üÜÿø\§3ÉÜÿ$¼¡ìSCÁá;ÑHr({Ñ¾`1Áéó¥Êáó¤C_^[Ç°]Â_Çz^°[]ÂCK¾;Îp[ ì_^ÇCPÇ°[]ÂCS¹P;ÑHæU{ 4¹ÁæÆ`1ó¥_Ç^°[]ÂCK3öùprK_M0^°[]Âs_ÇW^°[]ÂS_^°Ç[]ÂC_ÇC^Ç°[]ÂK_ÇC^Ç°[]Â{K¸D;ÈGsMVèdÇD_ÇCD^°[]ÂÑÜÿø,3Ò\ÿ$<{K¸ùGrC9Cr>CsHVMFRMPQMèUVÇ_ÇC^°[]ÂÇW_ÇC^°[]Â{C3öøwCHPQMRè¬s_^°[]ÂCK¾ùp29s){CP@OQMRPèKs7_^°[]Â{C3öøwCHPQMRèjs_^°[]ÂCK¾;Îp±9s¨{KQMGPRèW Ks7_^°[]Â{C3öøwrCHQMèU s_^°[]ÂÇWs_^°[]ÂCK¾;Îpr.9sr){CHWRQMèKs7_^°[]Â_ÇWÇC^°[]ÂS_ÇC^Ç°[]Âÿ XÏ1¡I¡ BÄK¡UììPVW3ÿWWh¨sh¬sèe E°jPPÿUuM°WQRVÇE°PÇE¸PÇE¼ÀÇEÄÐÇEÐ}ÀÇEàÇEÜ ÇEä0}ð}ôÇEÈ}´ÿN4;Ï ¤stÇF4P¤;Ï st Ç¤p_^å]ÂUì¡¤sÀtMQÿÐ]ÂUì¡ sÀtCMSQ`Zû[u(=¬su¨sÒu2ÒÇAÿ$3À]ÂQMQÿÐ]Â¸À]ÂUìET¹HH PPLH PDH @P$<H 8P,4H( 0P4,H0 (ÇDH8 Ç@DP<H@3À]ÂUìjÿhÀh d¡Pd%ìDSVWeè3öE0]3uÜMäèMàèûuü¹3À}Äó«ÇEÄuÈÇEÐuÌuÔuØM9}´u¸VhjU´REÄPhMàèúPè EÀ;Æ}hÀ5PÿÖë5PMàèÀPMäèÀuhÀÿÖ}¼M¼QSMäèPÿXÀ}hÀÿÖMäè²Uë7EìU¬¸ÃeèE¬= Àt-À÷ØÀ$ùÀEÜëÇEÜWÇEüÿÿÿÿMàèMäèÝEÜMðd _^[å]ÂUìEÀtPÿdMÉtÿ3À]ÂUìjÿhÐh d¡Pd%ì$SVWeè3ÛuMäèk]ü¡p8}ØMäè¦PSWhShMQè±EÔÀ}hÀÿPEEÜjjjUÜRjPjVjÿMäèMPÿhEÔÀ}AhÀÿPë4EìUÌ¸ÃeèEÌ= Àt-À÷ØÀ$ùÀØë»WÇEüÿÿÿÿMäè¿ÃMðd _^[å]ÂUìEÀtPEPÿt3À]ÂUìì$VÁWEôQPÿ\|¹3À}ÜUÜó«REü3öMôhPÇEÜuàÇEè@MäuìuðuüÿxÀ\|4¡¬sø¸81t¸1MUôQPEüRPèlEü;ÆtPÿ4_^å]ÂUìì EWMøPQÿ\|¹3À}à request_handle: 0x00cc002c	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $\Ð¥±sö±sö±sö±rö:±sön,ö±sö?wö±sö?wö±sön,ö±sö?wö±sö?wö±sö?wö±söRich±söPEdØÙGð" foà»:°(Àø PÐ,.textðab h.rdataÀf@H.data¤n@È.pdata r@HINITÆ°x â.rsrcøÀ\|@B.reloc¢Ð@BHL$Hì8HD$@HÀHD$(HD$(HD$ HL$(ÿ1pHD$@¸´tHD$@HøHÈè0VHD$@Ç°HD$@Ç´HL$ ÿ¯oHÄ8ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHT$L$HìD$ $<$tB<$t^<$ tU<$tëoHD$(Ç\|HD$(Ç@àHD$(Ç@ëNHD$(ÇøHD$(Ç@àHD$(Ç@ë)HD$(ÇÿHD$(Ç@ÿHD$(Ç@ÿë3Àë¸HÄÃÌÌÌÌÌÌÌÌÌLL$ LD$HT$HL$HD$HL$HHD$HÇ@HD$HÇ@(HD$Ç@0HD$Ç@PHD$HÇ@8HD$HÇ@@HD$HÇ@HHD$Ç@HD$HL$ HH HD$HL$HHHD$¶@!ÁøHL$I¯ÈÁÀàüHL$AHD$ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHL$Hì(HL$0è} HD$0HxtHD$0HHÿmHD$0HÇ@HÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌDL$ LD$HT$HL$HìøH$HD$ ¶D$!Áø$¯ÈÁÀàü¯$D$@A¸DrmDºX¹ÿ<mH$H$HD$PH\|$Pt,L$L$H$HL$Pè-þÿÿH$¨ëHÇ$¨H$¨HD$0D$!$°¼$°t+¼$°t~¼$°Í¼$° élÇD$(H$$¼$u Ç$´ëÇ$´$´$ ÈÁ$ éÇD$(H$$¼$u Ç$¸ëÇ$¸$¸$ ÈÁ$ é²ÇD$(H$$¼$u Ç$¼ëÇ$¼$¼$ ÈÁ$ ëXÇD$(H$$¼$u Ç$ÀëÇ$À$À$ ÈÁ$ HD$0HD$8¼$t#DD$(H$HL$8ÿêjHL$0HAë!DD$(H$HL$8ÿ¯jHL$0HAHD$0Hxu_HD$0HD$`HD$`HD$XH\|$Xt0HL$Xè´üÿÿ¸àÀtHL$XÿÅjHD$XH$ÈëHÇ$È3Àé,H$$ ¼$ u Ç$Ð+ëÇ$Ð+$Ð$ ÈÁ$ $ %ÿïÿÿ$ HD$0$ HHD$0D@H$HPHD$0HHÿµiÀu_HD$0HD$pHD$pHD$hH\|$ht0HL$hè»ûÿÿ¸àÀtHL$hÿÌiHD$hH$ØëHÇ$Ø3Àé3H$xXu9HD$0HHÿiHD$HH\|$Hu3ÀéHD$HfÇ@LHL$HÿKiH$xXHD$0L$@HPH$¸¨t\|H$HPpHL$0è¶ÀubHD$0H$H$HD$xH\|$xt0HL$xèÆúÿÿ¸àÀtHL$xÿ×hHD$xH$àëHÇ$à3ÀëAH$HÀ HL$0HA(¼$tH$HL$0HHHD$0Ç@0HD$0HÄøÃÌÌÌÌÌÌÌHT$HL$Hì(H$0H@XD$TH$0Hx8t ¸é@H$0H$8HH8H$0H@XD$X\|$XH$0HH@HD$`HÇD$8H$0@D$0H$0H@8HD$(H$0HD$ E3ÉH$0D@HT$`H$0HHÿCgÀu3ÀééH$0H@XD$h\|$hHHÇD$@H$0¶@!$$è$¼$w^$H ±æÿÿ¶ HÁÿàÇD$lë:ÇD$lë0ÇD$lë&ÇD$lëÇD$lëÇD$lëÇD$lH$8HD$ A¹DD$lH$0PH$0HHÿdfHD$xH\|$@tHD$@HD$pHL$pÿ fHD$xHD$@H\|$@u Ç$ëÇ$¶$ÀtsH$0HH$H$ÐÈH$ÐH$èõÿÿÇD$HH\|$@tHD$@H$H$ÿjeD$HéÕH$0HH@H$ HD$@H$¨E3ÀH$ H$¨ÿ,eÀuuH$0HH$ÀH$ÀÐ H$ÀÐH$ÀèçôÿÿÇD$LH\|$@tHD$@H$ÈH$Èÿ´dD$LéHD$@H$ÐH$ÐÿèdH$0HAHH$0HxHupH$0HH$èH$èÐÈH$èÐH$èè>ôÿÿÇD$PH\|$@tHD$@H$ðH$ðÿdD$ request_handle: 0x00cc0038	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $ytËÏËÏËÏËÏëÏ½aÏÌÏìÞwÏÈÏìÞgÏÊÏ½wÏÊÏìÞhÏÉÏìÞfÏÊÏìÞbÏÊÏRichËÏPEdÚÙGð""N À8Pd P° ,tP10.text² h.rdata¼0 @H.data\C@D$@È.pdata,h@HINIT` j â.rsrc °p@BHT$HL$HìHHD$PHHD$0HÇD$(HD$PHD$ E3ÉE3ÀºHL$Xÿ, À}HD$PHL$0H3Àë$H\|$0tHL$0ÿ$ HÇD$0HD$PHHÄHÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌDL$ LD$T$HL$HìhH$HD$@$HL$@HAHD$(HD$(HD$ ÇD$0HD$@H9D$ v<HD$ HèHD$HHD$H·ø\uD$0L$0ÁL$0ÀtëHD$HHD$ ë¸HD$ HL$(H+ÈHÁHÑøHD$8D$xèÀH9D$8sHD$8HD$PëD$xèÀHD$PHD$PHD$8LD$8HT$ HL$pÿHD$pHL$8fÇHHÄhÃÌÌÌÌÌÌÌHT$HL$WHì3ÀHÇÁÿÿÿÿH¼$¨fò¯H÷ÑHéHÁH=ÿs%3ÀHÇÁÿÿÿÿH¼$¨fò¯H÷ÑHéHÁHD$Xë HÇD$XÿD$XD$ D$ H$ HÁLÀH$¨ÿñD$ H$ fÇDAH·HD$`H$ HHD$hHD$hHD$pHD$`·fD$xHD$h·L$xfHD$`HÀHD$`HD$hHÀHD$hf\|$xuÂH$ HH$3ÉH$HÇÁÿÿÿÿH$HÂH$Húfò¯H÷ÑHéHÁH$ HADL$ L$¨º@HÈèsýÿÿHÄ_ÃÌÌÌÌÌÌÌÌÌÌHL$ÃÌÌÌÌÌÌÌÌÌÌDD$T$HL$°ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLD$T$HL$Hì(H Wè²ÿÿÿ3ÀHÄ(ÃÌÌÌÌÌÌÌÌÌÌÌLD$T$HL$Hì(H Gèÿÿÿ3ÀHÄ(ÃÌÌÌÌÌÌÌÌÌÌÌLL$ LD$HT$HL$Hì(H 1èLÿÿÿ¸àHÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌLL$ LD$HT$HL$HìhHD$pHD$ H$8BËo oÁ oÀt ¸7éH$Ç@H$HÇ@ H$HÇ@(H$Ç@@H$Ç@8H$Ç@<HD$ ÇH$HPpHL$ èÍüÿÿHL$ ècD$(T$(HL$ è¡H$Æ3Àë¸WHÄhÃÌÌÌÌÌÌÌÌHL$°ÃÌÌÌÌÌÌÌÌHT$HL$VWHìèH$HD$8ÇD$0HÇD$@H$$Ð¼$Ðà.#wT¼$Ðà.#à$Ð-#$Ð¼$Ð\ $ÐH Aêÿÿ¶üHÁÿà$Ð-ð.#$Ð¼$Ð,Ê$ÐH þéÿÿ¶\|HÁÿàH$@( HkÉPH;Ár6öHkÀPH$HÇHy HòHÈó¤ÑHkÀPHD$@ëÇD$0zéSH$@(Hør)H$H@ HD$HHD$H HÇD$@ëÇD$0zéH$@(HøPr:HD$8HcHkÀPH 2HÈHÁH$Hy HðHL$@ó¤HÇD$@PëÇD$0zé´H$@Hør!H$H@HD$PHD$8HL$P ëÇD$0WéuépÇD$0écÇD$0éVH$@(H=r:H$H@ HD$XHT$XHL$8èD$0HD$XÇHÇD$@ëÇD$0zéüH$@HøH$@(Hø rH$H@HD$hH$H@ HD$`HD$hH@HD$pHD$`HÀHL$`HÁLÈLÁHT$pHL$8è)D$0HD$`HL$pHHHD$`Ç HÇD$@ ëÇD$0zéJH$@Høs ÇD$0Wë1H$H@HD$xHD$xL@HD$xHPHL$8è, D$0éùH$@HøH$@(HøH$H@H$H$H@ H$H$HÀLÈH$L@H$HPHL$8èðH$HIH$ÇHÇD$@ëÇD$0zéBH$@Høs ÇD$0Wë:H$H@H$H$L@H$HPHL$8è; D$0éèH$@Hø³H$@(HøH$H@H$ H$H@ H$H$ H@H$ÀH$HÀHÇD$(HD$ E3ÉE3ÀºH$Àÿ À} ÇD$0 ÀëÇD$0H$ÇHÇD$@ëÇD$0zéH$@Høs ÇD$0WëUH$H@H$¨H$¨H@H$ÈH¼$ÈtH$ÈÿHÇ$ÈÇD$0éH$@Hør{H$@(HørjH$H@H$¸H$H@ H$°H$°HÀLÀH$¸HPHL$8èD$0H$°ÇHÇD$@ëÇD$0zëÇD$0H$H@L$0H$H@HL$@HH°HÄè_^Ãff request_handle: 0x00cc003c	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@pº´ Í!¸LÍ!This program cannot be run in DOS mode. $Òæ @³ó@³ó@³óLóB³óguõóB³ó@³ób³óóC³óguåóC³óguæóO³óguôóA³óguðóA³óRich@³óPEL¶ÙGà!TLUfT[[(_øfPcUU.text@PP h.rdataUU@H.dataZZ@ÈINIT@[[ â.rsrcø__@B.reloc&cc@BÿUìQMüEüMUüÇBEüÇ@MüÇA UüÇB0EüÇ@$MüÇA(UüÇB,EüÇ@MüUQEüMHUPEü¶HÁùUü¯JÁáüEüHEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìQMüMüè/EüxtMüQRÿUEüÇ@å]ÃÌÌÌÌÌÌÌÌÌÌÌÿUììdM°EEü¶MýÁù¯MÁáü¯MMìhDrmDj4jÿUEÈUÈUä}ätEPMQURE°PMäè±þÿÿE¬ëÇE¬M¬Mô¶UýU¨E¨èE¨}¨£M¨¶Èÿ$´ÇEøE°HhMÄUÄê÷ÚÒâUUëmÇEøE°HhMÀUÀê÷ÚÒâUUëHÇEøE°HhM¼U¼ê÷ÚÒâUUë#ÇEøE°HhM¸U¸ê÷ÚÒâUUEôEð}tMøQUREPMðQÿUUôBëEøPMQUREðPÿUMôAUôzuDEôEÜMÜMà}àt$Màè)þÿÿºât EàPÿUMàM¤ëÇE¤3ÀéjU°BhE´M´é÷ÙÉáÁ+MMUâÿïÿÿUEôMHUôBPM°QREôHQÿUÀuDUôUÔEÔEØ}Øt$MØèýÿÿ¹át UØRÿUEØE ëÇE 3ÀéÐM°y8u0UôBPÿUEè}èu3ÀéªMèfÇA0UèRÿUE°x8tfMôUìQ0E°xxtTM°QDRMôè²ÀuAEôEÌMÌMÐ}Ðt$MÐèäüÿÿºât EÐPÿUMÐMëÇE3Àë(U°ÂEôP}tM°UôQEôÇ@ Eôå]ÂIAf®ÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìì\|MEQ8UìEx$t ¸é£MUQ$EQ8Uè}èuIEQUäjEHQUB$PMQjUBPMäQUBPÿ$UÀu3ÀéEé;MB8Eà}àÇEüM¶QUEèE}wGM¶àÿ$ÄÇEÜë4ÇEÜë+ÇEÜë"ÇEÜëÇEÜëÇEÜëÇEÜEPjMÜQUBPMQRAPÿ UEÔ}ütMüMØUØRÿUEÔEü3É}üÁ¶ÑÒtJEMÈUÈÈMÈMÈèÇEø}ütUüUÄEÄPÿUEøé"MBEÀMüM¼jUÀRE¼PÿUÀuMMU°E°ÉU°M°è)ÇEô}ütEüE¬M¬QÿUEôé°UüU¨E¨PÿUMA,Uz,uGEMUÈMMèÀÇEð}ütUüUEPÿUEðëJMüMÇEüUEB(}ütMüMURÿUëEQ8U}uë3Àë¸å]ÂÿÂ Ë Ô Ý æ ï ø ÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUììMôEôMøUøUüEøPÿ,UMô¹tMôÁ´èÏ8UôÇEôÇMüQÿ(Uå]ÃÌÌÌÌÌÌÌÿUììMìEìQ8Uü}üu7EìQUøjjjEìPjMìQÊREøPMìQRÿ$Uë^EìQ8Uô}ôuBEìx,tMìQ,RÿUEìÇ@,Mìy(tUìB(PÿUMìÇA(ëUìH8MðUìÇB$å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìì MàEàÀEìMìU}1hDrmDhjÿUEèEèEðMàUðQEàxu3ÀéMàÇAUàBEüÆEõÆE÷ÆEöÇEøë MøéMø}øtZUüEõMüU÷QEüMöHUüÆBEüÀEü¶MõÁ Mõ¶UõÒu¶E÷À E÷¶M÷Éu ¶UöÂ@UöëÇEøë EøÀEø}ø s2MøZEàHEøMø(ZEàHEøØë¿jjjMàQRhjÿ0UMàAë?UàÂREPèÀuë2ë0MàQREàHQUàBPjjjÿ0UMàAUàzu@EàÀEäMäÇUàÇBEàxt MàQRÿUEàÇ@3Àë¸å]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìQEEü}ü w}ü t]}üt5}ütKëh}ütë]MÇ\|UÇBàEÇ@ëBMÇøUÇBàEÇ@ë#MÇÿUÇBÿEÇ@ÿë3Àë¸å]ÂÌÌÌÌÌÌÌ request_handle: 0x00cc0040	1	1
InternetReadFile May 13, 2021, 3:59 p.m.	buffer: MZÿÿ¸@`º´ Í!¸LÍ!This program cannot be run in DOS mode. $PöÕð>¥Õð>¥Õð>¥ò6C¥×ð>¥Õð?¥öð>¥Ó-¥Òð>¥ò6S¥Ðð>¥ò6P¥×ð>¥ò6B¥Ôð>¥ò6F¥Ôð>¥RichÕð>¥PEL·ÙGàJak¦LaPe kPi( @@.text h.rdataä@H.data\BB@ÈINITìaa â.rsrc ee@B.reloc ii@BÿUì]ÂÌÌÌÌÌÌÌÿUì°]ÂÌÌÌÌÌÿUìhpèÑÿÿÿ3À]ÂÌÌÌÌÌÌÌÌÌÌÌÿUìhè±ÿÿÿ3À]ÂÌÌÌÌÌÌÌÌÌÌÌÿUìh°èÿÿÿ¸à]ÂÌÌÌÌÌÌÌÌÿUìì$EEüM9BØ`¡Ø`À£Ø`Òt¸7ëzMÇAUÇBEÇ@ MÇA8UÇB0EÇ@4MüÇUBdPMüè4MüèÌ EøMøQMüèý UÆ3Àë¸Wå]ÂÌÌÌÌÌÌÌÌÿUììdMàEEÜMÜÁMØUÜffEÖEÜf}ÖuëMÜ+MØÑùMÐ}Ðÿs7UUÌEÌÀEÈMÌffUÆEÌf}ÆuëEÌ+EÈÑøEÀMÀM¼ëÇE¼ÿU¼UüEüPMQUàÂRÿÄEüMàfÇDAÇE¸ÐUàÂU´E´E°M¸ffU®E´fM®fU¸ÂU¸E´ÀE´f}®uÓMàÁM¨U¨ÂU¤E¨ffM¢E¨f}¢uëU¨+U¤ÑúUEüPMQj@UEàPQèå]ÂÌÌÌÌÌÌÿUììEEìMUìJEøMøMüÇEôUü;Uìv.EüèEèMè·ú\uEôMôÁMôÀtëUèUüëÊEø+EüÑøEðMé9MðsUðUäë EèEäMäMðUðREüPMQÿÄUðEfÇPå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUì°]ÂÌÌÌÌÌÿUììTEEøÇEüÇEôMU¬}¬à.#w3}¬à.#ME¬-#E¬}¬\×M¬¶\ÿ$<E¬-ð.#E¬}¬,±M¬¶Üÿ$¼¡<kÀPM9Ar,<kÒPRhEHQèÄ<kÒPUôëÇEüzé_ExrMQUðEð <ÇEôëÇEüzé-UzPr+EôPMøkÒPÂREHQèÄÇEôPëÇEüzéíUzrEHMìUøEì ëÇEüWéÃé¾ÇEüé²ÇEüé¦UzHrEHMèUèRMøèEüEèÇHÇEôHëÇEüzégMyr\UzrSEHMàUBEäMàQUÜEäÀPMäÁQUÜRMøè#EüEäMÜHUäÇÇEôëÇEüzéöExs ÇEüWë"MQUØEØHQUØBPMøè8Eüé½MyrRUzrIEHMÐUBEÔMÔÁQUÐBPMÐQRMøè/MQEÔÇÇEôëÇEüzéVMys ÇEüWë"UBEÌMÌQREÌHQMøèHEüéUzrfExr]MQUÄEHMÈUÄBE´jMÈÁQjjhU´RÿüÀ} ÇEü ÀëÇEüEÈÇÇEôëÇEüzé¢Mys ÇEüWë/UBEÀMÀQU°}°tM°ÿÇE°ÇEüë_ExrFMyr=UBE¸MQU¼E¼ÀPM¸QRMøèH EüE¼ÇÇEôëÇEüzëÇEüMQEüMQEôB°å]Âv¾ð0 Z _ k I¶ ' ` Ç {¾ÌÌÌÌÌÌÌÿUììXjjhÌ`hÔ`ÿÄjPE¨Pÿ=Ô`u ÇE¨(ë3=Ô`vÇE¨PÇEØ°ÇEÔÐÇEÜðÇEèÇEìÇE°ÇE´àÇEÈ ÇE¸ÇE¼ðÇEÀÇE¬jM¨QUREPÿEüEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìÿ]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìQMüEü¹ðÁAÁå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUììMøÇEüEÇHMÇAUÇBEÇ@iMÀQE ¼HU¡¸BM´QE °H U¡¬B$M¨Q,E ¤H0U¡ B4MÇA<UÇB(à E H8U¡B@MQDEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿUìjþhhÀd¡PÄSVW¡À`1Eø3ÅPEðd£eèMEÇMÇÇEÜÇEàÇEäÇEü3ÒUÀUÄUÈUÌUÐUÔÇEÀÇEÄÇEÌÇEÈÇEÐÇEÔE3ÒM°U´jhjE°PMÀQhUäRÿÈEØ}Ø}hÀÿ request_handle: 0x00cc0044	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001c1a00', u'virtual_address': u'0x0000d000', u'entropy': 7.995278771626069, u'name': u'.rsrc', u'virtual_size': u'0x001c19f0'}

entropy

7.99527877163

description

A section with a high entropy has been found

entropy

0.978509249184

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (6 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 13, 2021, 3:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (2 events)

process	easyon-1.exe
process	clientrun.exe

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ipconfig.exe /flushdns
cmdline	"C:\Windows\System32\ipconfig.exe" /flushdns

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
service_name	SeetrolClientService	service_path	C:\Program Files (x86)\seetrol\client\"C:\Program Files (x86)\seetrol\client\Seetrol_Clt.exe" -service
service_name	SeetrolMyService	service_path	C:\Program Files (x86)\seetrol\client\"C:\Program Files (x86)\seetrol\client\SeetrolMyService.exe"

Operates on local firewall's policies and settings (1 event)

registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

Detects VirtualBox through the presence of a file (1 event)

file	C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf

easyon-1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All