Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 3, 2024, 7:07 p.m.	July 3, 2024, 7:09 p.m.

Size	1.4KB
Type	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5	`b75a49ff9b2f445e17519d2e743fe1b4`
SHA256	`979dcbbe8f1d6f5a70395cf90ca9420b82f06a06fa470ab49a44331041f00230`
CRC32	`B6FD78F2`
ssdeep	`24:fP0adiHuYCJM917Lw1rCmM01WEWvEe7L0Y92+5R7dxLQUZSzCC4fQCC:XziIW/I1rCliWEWnBR5vxTZ2CzoN`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\file_xgep41gp.dyp.txt.ps1
2556

Name	Response	Post-Analysis Lookup
uploaddeimagens.com.br	A 104.21.45.138 A 172.67.215.45	172.67.215.45

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.215.45	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49163 -> 172.67.215.45:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49163 172.67.215.45:443	C=US, O=Google Trust Services, CN=WE1	CN=uploaddeimagens.com.br	73:a9:e0:a5:b1:5f:db:89:38:94:4f:97:4d:68:78:e4:59:c5:9f:a5

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 3, 2024, 7:07 p.m.	computer_name: TEST22-PC	1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235

Performs some HTTP requests (1 event)

request

GET https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0203b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0209f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02019000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02099000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05611000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 3, 2024, 7:07 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05621000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 3, 2024, 7:07 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (20 events)

Data received	[
Data received	Wf"þÚvd*YaûÌú,ììòI1sÔRDOWNGRD _GÇ;aõ8U>%"M0ËÙBwJÄ¸WK)[À ÿ
Data received	ø
Data received	ô ñÇ0Ã0j òaù³Zª 6hw8 l0 HÎ=0;10 UUS10U Google Trust Services10 UWE10 240611225025Z 240909225024Z0!10Uuploaddeimagens.com.br0Y0HÎ=HÎ=BxJ_ÍYºOC0êm3·QÀ4EåNãÀF<30am×&ý!.\|sÕT[BdÿÇ4Á£h0d0Uÿ0U%0 +0Uÿ00Urq»òà²Ìl¨¿nË»t0U#0w5gÄÿ¨Ì©æ{Ùy{Ìù80^+R0P0'+0http://o.pki.goog/s/we1/DvI0%+0http://i.pki.goog/we1.crt0;U402uploaddeimagens.com.br.uploaddeimagens.com.br0U 0 0g06U/0-0+ ) '%http://c.pki.goog/we1/0b07lKySgU0.crl0 +ÖyôñïvîÍÐdÕÛÎÅ\·´Í¢2F\|¼ìÞÃQHYFqµ µÈRG0E!Äøgó)bYÀËUøFñFfjVÒ«^Ñý 'þ!bØæJ¿[[%ª^nÐ«eÄ¡Ej'PußáVëª¯µq¨À2N®VÙn§õ¥jÑÁ;¾R\ µÉ(F0D -ãÙÛààúâ!¾ù¦Y6ÎÌú¿; y,@R _ÁFo"ÞæY!®Ú²¢1Ýj00 HÎ=G0D o1xð·»ÆÅèÀX\|óf$ÏMM½ÕÖªµ%\ pnÐÐÏ_ÜQ¿m¥¿òÿê¾ràië«`»á4rF£00% ów,"Jv]¶Öã0 HÎ=0G10 UUS1"0 U Google Trust Services LLC10UGTS Root R40 231213090000Z 290220140000Z0;10 UUS10U Google Trust Services10 UWE10Y0HÎ=HÎ=BoÍ:þgWGL!@ÂG]»XG@Á\Æ7çÕ\|íKÙ×¥ øÄÆèÿY,&õæ&%»úV£þ0û0Uÿ0U%0++0Uÿ0ÿ0Uw5gÄÿ¨Ì©æ{Ùy{Ìù80U#0LÖëtÿI6£ÕØüµ>Åjð04+(0&0$+0http://i.pki.goog/r4.crt0+U$0"0 http://c.pki.goog/r/r4.crl0U 0 0g0 HÎ=h0e1ç«QÖ÷CÎuþÑÕÌ@Az&¾Øó2-=®#HR>dy¯õ¦,nU±0&Ìhbç«~èÖD~ãLI¿lb4¸²¡~:P¼§ }sìRAMîâV~0z0b å0¿3C¾ÝI=0 H÷ 0W10 UBE10U GlobalSign nv-sa10URoot CA10UGlobalSign Root CA0 231115034321Z 280128000042Z0G10 UUS1"0 U Google Trust Services LLC10UGTS Root R40v0HÎ=+"bóts§h`®C¸5Å0{KIûÁaÎæÞF½kÕa5®@Ýs÷0Zë<î\|¢@v;©Æ¸GØçjsé±r9)¢Ó_^Xe¡eÑÜÉÇsÈj/åÄ«Ñ£ÿ0ü0Uÿ0U%0++0Uÿ0ÿ0ULÖëtÿI6£ÕØüµ>Åjð0U#0`{fE ÊP/}Í4¨ÿüýK06+0(0&+0http://i.pki.goog/gsr1.crt0-U&0$0" http://c.pki.goog/r/gsr1.crl0U 0 0g0 H÷ B»Öã?c ¤¡hH9"søËN-1éç ¡Ò6¬yëé°ëj¶{}t¸e«h,,ÝBýÆqÏ-÷kÈn}Vâ#XXù%ºG× ý ¶à.®UÑyu5,1[?e¼ÍB§±^ñ»Ê-Gð¬c~¿ÖäkÓÖÓgX¸ÿ÷¦ IP[?:%ò\ÓyW6Îÿ&·©ñí>ÈnëÓ<8ÀAá^SÏ> Wëîâ?H¥ñ¾Ñj#û?/¢µ½ên£FÎ.g¯3&ªÕKÒ©6Å&;[Áå
Data received
Data received	A³ætî£Z#÷w'°0Í-öõeÇZI3Ü8GQó³wXS·~M×"Ë8×cr¿@ m9³±5º:G0E!¹JÈwg`hëj9¹zÎÀÕ~£ßdñÀV°6kÞ4 càèd)¢hýf:âA¥°ÏÏ{'N:A*WÅ
Data received
Data received
Data received
Data received
Data received	0
Data received	R 6°ðeºýð,»Äåbçé,\!$Î×P«Ýf\B±ÕônåVw
Data received	p
Data received	¿WYÕÌ0yWaK·Z^ÒäèåñáóóÉÎVzÒ8æùD" crýDÂ -=´>Ùå w~£ º½"bª(Ð`³àÆÉ"±«ÄjøNÃÀ,±pF×¹B§J/Hë°IÔÀ6#Â²/ê ùAX4ÅRÎ¨4ðÑtµÜ ÕÝ±çÙÆ×ñûnu:A"sÐØBzî¹-ºeð¢,:ju@æ:D¹UÉ²ÜÚb÷#[Xïä÷2¦<' Ø Ø3¶ÆÞQX^}~Dªâ5¥©iØDV;%û5[Ùg×0~¥¨l¯aN ªô¢Oº 1A¶pÚ"töª\|ø@l@à:LRº5ÅîcÊÌKÎd'?ycº4æLxA#4K´ % r¾û½Â9ø(SuþHÔhªDÑ »ÌkMé¶oÅêo#ÿ$ÌÎË!§ã[¨m@&«³>kµ2L8l\|$Íð%Id°0~·¯^.èÎò¨évÆ³p"Rç;[5ã©ÆÀ¡)8ÎRiIîS:XÑªLÅôHq"ÕÎ¸$Ñ¢ç"\2!ÅTÙ»kxë1YÑÆô/å%VïX5Ç ¢BÙ\ñÞ®H<üHâ±ðÑw7.Xî7{ZÏ06õæRÂ.vNÁÞßvZ,Øû[¡ÖÈ èÀ¹_ ¤nøö½TÝâ\|x²-è`: =¾a£&Y0{gfÃ~SU8:$Ó =®\|üä]ä-ÔN¤+gbfÎµ>\|"[iôiþ`búÏ¿&mÆ¿6¿jÙ:ÂZÒÁa¨?ì\ã7äÓ§#òßëÅ°°-CJt·4)"¥· ÒÄ¯¾é«¿ç'/Åó²}b±?ë¼uzõ³ð(é3+ríîºÕU ·éNµÖÊQO]õ±37¯õm¨´ål7PE1ßvgÈF-×F¨Pw°×ëP\bùgÐ??Æx!§àù>4=Ç(ÊÊxÎé? ¦µ0qu2:³R¦¿Xøh gØ¢ãpmiþnÀí/V¦+LÅ TmvÁNïªZôáFm£´ù/ÀÙ\|{iá/ýè7ÄJãR&¥uT$äÀþYYHUg3`@,/Ò=@õû¢ó3tÂ½«çêi?í0àÌÁå°Õf!ôÖQÓ6 jMðbëwx#áÁ©¶ÔÛmê6ð>Áz©ÚsÌ½ÿoÄïj=ÃeÍ8e+JÝï= º\|dKòß {ÿ® é¬ÌhÏAA$Ö1=W¬ Êç¢hÏ¸N¸æ8\¡=ìé7÷§i¯Ar)Ø)ùb§[/¡ZH¡[ÜÐûÔ¸µãÛ·p4±Gõ±QèÜ¥¼b·Þç19r¹LIú¦×{.Eêøß³ ß?$[,³)åSûðMz_kNp,Öõ èR©¥fÛò¼Ì7Hþ´½ÉMîïY3,É¬äz`¥@óÇë;´gÉ·vr'Ëñ5Æs\|û.úpôjFAðuo2ÐÏÕyýqÆAö÷Á,Ë>p=§Ð,}ªï>fYâ0>ðÚ!Ä®&}û=×Fz' ßÏ4zÓ³(HPØ¿Äw/Ö
Data received	)A¯éRe#ê$i¤8ûWêôµ^®JaÐH%ovÖ]{uâ¨øu8ÔÆbã¬GÉÛPü tA,P¦xÅ¸[ÕpÎüéH{Ñ/ðíª+ë³Wæî,$ÝZ.moã0¬vI73òÂcÂÍà×Ã½¼ºúµ(o©$~Y¡;Ç·ÒË,²l£-ÝgRª;ßìþXl räÅprfMõï¶åyî¸Dx6;§°A]ÐHh®äñpµÇØ©¬Å4hO½9¨ÅÊ²ó@¨ïý0(MÚÜÆr."U I,X×ØqÝåcýyÏ&þ=®ä[&â;¾gGkhÖIhãP¨ñÙ²³è¼]}{GÔ¤z}\|{\ e{ëôÐõÎ²bïW,ÖÙôÖÏ¶âj$,G<åô¦NsérKÞô7³ÏüÄwµ¼YöµoÐ Ñ0&§(ÈÒ^ô`¥DFÙBIgi·J¡?;5ÑÅ§ñazÓÝ#Æy×»Ì.Îy»9/o(¶½Ï@ÿÇÜf îA 6É!ÒE»Tôøè©zÒKVoGAÇ_LìZ°nXzý^ìz5]Ë7_8)Å3I¼åþ6Ã®ÖpòÌþ9µ½n®o5_Ö ËêdÁ5ÜmO]K$¨Mý(\|òäâZLÇ6\|JD¾i¯òy¡Hù#S]¿9út}bÍ¸SÊxÙjfA$ë '9c"åÝËäe9ù=obáÉûö=flQó{²´[ÈÎ¿ïDÊÉn³ÈãÇÒ¶Ó)k3÷6HÑùÅák98¬¨_ý¯ÙQÿçGo@Arô.ÞÂÌ(®hÖËDµ¶UñOùOz =`AL]@¼ ¨ALà¹°AûûRJñQÎ÷!i¸xÿµÈ«1aè/fÈïå¿yÝ ¸ëØýgJøWª37cî É¾ÿ¥¸¦ðð®t±PÉA9p"èU$}»Lz»°÷FïÚ!Ü´DÃkê%\ñuîÙï ÂjÙ)£HJã´þßºÒKGfmÿil9Ú¤5¿"t«VëHÓ^©ÞrLö&#(&ûcQ-ÉQáá°Ùç¦\±£$ÿëyJÒÌÐ×4Ö,wCõÖ8ßM×WÞ8Ñòpo{Ïî@Îx'ÊÌÁl@cÔ0ðÓ$ !Â;FÅ$v è#Âòàû^¥ðÔàê@[.ÞÝE<ØmWÆCwK Þ9,È¤´bY%\|Nè[µ¤meÞW+Hýîï_@ UÖïÙX]_»¥,ZÑ¶Õ¦¹jè\|hÚÒýâ/à&Xã2vÛ_ë7^÷¿ABç«îªå.OK}§ÙÊ«§t»;+écf eKö±Ê$YqêHÞdµåû£úh»-eðþ"Å¿ñÇíJo.i4Òï¦dZèUï±Ç#HþÔQñX)9?j»¸-A.ëmzV¬ËpË0±SüDã\ÛDwzPq4°pf=D¥H¯t¾KôæxñÂ^ÂÓ:\ÇÐó;ää¾£=¼fYbßYhC-¦Ó)2piA¸¹>m<3U¢w¤a¢.Ê£®I¸!»ßCÉ7CÛ»[dÌBnLü`YâOgÌ¢·ÃR®I;(W
Data received	Íý6à{8-¯ñ¬Õ<xë1 5·$Û¼ Çv ¨1u;EÿíÈ ¸`)sÁäáý3¼ ü×Úú ?ËôÌËwjµV2_½í,F@:ãqyÄébÆð}Î.^¢®O0Y\|ÂêñÞì ¦mI?Èè,àbV°¬Cáy\jÉGn;Ï]u cúÒåTÐá_©ûHûÒ¾ãVÔ×6\Ç¡ÓV\¢b¾¾ä[þ,Ù=g/ TN¦¦×V\|Í§]äU#üó9$vÁaÙö±ÄI95vû8PÉÔdP<kOÙýh=ª0.}Ë ÙQ÷\Öu,_Dî"oT> óÇWè»Þz7éQifñ÷3k«}DftÑà 5©J¸7íÃnb!ZÇRâ$ú- mÄrR-AU?»Ó0ÁE>g$NÊM o' îÈ(^ PlËÙ\ßx?MÞD\|¹ ô'.ÂÃo?"ÖÖÝ#Fnq16Uÿy6G»% ±h9sûúô6èËY»ãËnaoFÂñÃqk¢ÀmyJð´èÔ{îæa5a'¡Y«øöògS4ø'A ú#¥%'Í\|î×ÂÌH/0{ùµÈÛ_-DÒiZCÓhüÖ6f6¢» Á¢V7~xpú4,íº¥Û}=ÓdñæZ¼=}&ºEõúE¨[\ õ¤fcm.YD(.B½[º±HÈ¤QHf#U`8 D(Y%%w¡\"KéP¥Ð?ñúÝõFMK¾Ò¯KÓDDmF\¹<J&Å,ò{×PFâ¿>ðI^ Èídò·efz#$k-ÙÁÙ{;¢ë/ðÎµHËºcTåµèai2ûÿ1äàO[cßhÁn4õC\ÿª¯«æ¿aâ=G<óO+=÷¯ÉS`ß'ÌúÍ+XIÜ#ùrÜ¯Á\¾=¯O³JãmÐóiê´sV[ì~b[ 1®ùo'èÃ<îxpGpp`ÑX¾IhTÕ+lW±Øì_Ý`êªúÔ¾<²VúúP¥`ÉÌÍ1´-0³pm§zèØ °Ó&9i ¶6Gbf{´À2Jþ$A«®T°Ùbª«rµ+§C?ç,u÷=W\|ÿV»¥ÈîÂMvb®`¤ÉÚÚ7ÌRÊ§]\|ÚÖN=u¾ùhè#y¹d 4IJç%9üg5õáp<'FøZÜ¸Á ´#<°Å AKÄl½¯?aP<C sêP%ØÂuÍ«P0ÖMt«6¬JD ]È¼t¹J÷i)]0ÅÝè-7 8?«Ó1E>åâ¡!ÉfBõG4¹mûq_ük³£4Þs¶òê(3á?Ëûh9 JU´Èâ6ð $È6×§~¡È©Â×_ÐÿßFâHgüIvÕ¡ºw35ô~\|^E\foxkÄáiµºÁtÕiÖõó+ScC¦f²U\â'â/_²Ë=¥ßôÐ0´=ßÇ¤"hÊÝû¸[WÍ¯èLcçavFQÙWØ9rúhýþ£TÔ£PÒùçIeòh¿³Fñ¦ÿO2AÍ³l-g)N¡Ç3®óP0®Ä-¸æIâÜßºªý ¨¾GÜ<G£èÅõ
Data received	Ð
Data received	\|u1Q~¹'B²¡¤Ò]á¥Å¿ìòØt'ýî Ê6°ÝéØËñç1öÐûo`} ªÄ9Ðí ¾Bi·½O[ W»£Ò=Çr2º©®Þè©Èfï³ÝËå^Øè¨WìÏ¨÷Mû(ZCKA7P? ¹Çç\|ôù7ðÐiÅðXW¢_2äÈüâêÙà<ÿÐ¼¢ñ« 'éêy°U]ÆºB×¾m(ÚàYVÄÖUÂÒÿ®N#5eã:ë®U¾òvkÏØÚÖè¾ý]{Ì(½}æ/O±qµlÌ+)e9¡Yp`tò(0/ÏY&®wuÿøúýcãðeöÛæ¥õJ#\|T`É&âOL¯<¨í \5s.»xÁ^ÐAßË±æcP+d©#9^9¡äzÂð°¬ß¯×»7Òe[(¡(?ý6ïE4ÉÆJnN_ÈçÂzöÐäýWàqÛºVçÉEò©NRÞÀkäI¨¸Ô_#¼_òå,ÀÀàv[Ë-»}2öXÄ<ÍL ºv¬iøAøLxþ¾õô¯Bw2uàÂe&³Ã\|¶aÎHÏ¡<þ\ÖèÜ¦j<ùæhþó4]È8àzFPf'70¯¡Lm§]¶Y&DJT²¯¯n»uïH£À7FÜÚ³AªRä\|w~E$¶cBÿ£¿Ãµï±8\Ë/h§¹ÎGA]#'vÇ6Ýúñ:w%wkÓã]÷åP\|ÖÈÌÎû®Øf3úô%¶Eëj'sÊiæ9;¬É_k[JÃsXà/¸ôll«×_Æ»ÈØ±tøa}â<ÏSLDj´rµN>ø Áe-däÃ/âÎÃA"Õ¯·!8èaÙîy¡[«T>ûxì{ãÇàµ;I+ ºµ1\ÊQ""X}:=T)ðí7M Ku!ÒÇ¾×y8ÏÕÁCº $æj-líµûú&¥¡ãÑC-f#÷ÌTw§h5¸.Ä+¬9b&Þöuä@ÒÝN#$L=ÕÄK«þûïãoOd®¥¿ê`sÜÑúrE`%Q¸LDöé ¤DàzßJÇõÖÖÁâ$¥ÆWß5nðâ #
Data received
Data received	2¬DÓf¸ß9®Îùlø(_[Àì(½±Êª,@¹¬gÃ

Poweshell is sending data to a remote host (3 events)

Data sent	yuf"õAá'gX¶¢ ç°]èüI3jÝó"f=Æ/5 ÀÀÀ À 284ÿuploaddeimagens.com.br
Data sent	FBA¶:½¯¦Áî,R¶2cÔÀ1ybO7îëN>«¨ÿYùLÕÌr"ªáÐ6ë9»À" gLnYKÀÏ0é«ß¿Á³áhP'ÛÎUÛWKÚü;ñq«)=» ÝV¡µwAómv
Data sent	S6â3vs.ÎSÊl x¶Ð@Ù{¨(¶!6<ôÕKÃÂ±¦:ïÀÌvYíÏã,¤B1òÅ)×ÞÞã(¥¯þ{¶§m!PþBÖÜWÐÇô=§)M$â1åaP¿º²v)·W#ö2í¦mÌ¬<vIììøsëðÝË<ÀÑç_éä

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send July 3, 2024, 7:07 p.m.	buffer: yuf"õAá'gX¶¢ ç°]èüI3jÝó"f=Æ/5 ÀÀÀ À 284ÿuploaddeimagens.com.br socket: 1536 sent: 126	1	126
send July 3, 2024, 7:07 p.m.	buffer: FBA¶:½¯¦Áî,R¶2cÔÀ1ybO7îëN>«¨ÿYùLÕÌr"ªáÐ6ë9»À" gLnYKÀÏ0é«ß¿Á³áhP'ÛÎUÛWKÚü;ñq«)=» ÝV¡µwAómv socket: 1536 sent: 134	1	134
send July 3, 2024, 7:07 p.m.	buffer: S6â3vs.ÎSÊl x¶Ð@Ù{¨(¶!6<ôÕKÃÂ±¦:ïÀÌvYíÏã,¤B1òÅ)×ÞÞã(¥¯þ{¶§m!PþBÖÜWÐÇô=§)M$â1åaP¿º²v)·W#ö2í¦mÌ¬<vIììøsëðÝË<ÀÑç_éä socket: 1536 sent: 165	1	165

file_xgep41gp.dyp.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All