Source: wscript.exe, 00000000.00000003.1863971146.000001C3F5C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647357148.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864003124.000001C3F3DAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866018644.000001C3F3DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866353799.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864323075.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863420731.000001C3F3DFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1865300591.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863781030.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647382977.000001C3F5C70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866332730.000001C3F5C60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866102564.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864053875.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647412566.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx |
Source: wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx& |
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514604768.0000000002D46000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx1 |
Source: wscript.exe, 00000000.00000003.1647951336.000001C3F5C6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647746112.000001C3F5C64000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx_Gen |
Source: wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239689570.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239764275.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237881294.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237816496.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237921978.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239108798.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238346257.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238891411.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2239781243.0000000004F50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489300119.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2486802582.0000000004F51000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspxd |
Source: powershell.exe, 00000002.00000002.3005878535.000001C2F3870000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.microsoft |
Source: powershell.exe, 00000014.00000002.3174766864.00000000071B2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.microsoftx |
Source: powershell.exe, 00000013.00000002.2667964650.00000000035B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.microu |
Source: powershell.exe, 00000002.00000002.2992946262.000001C2F36C4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.v |
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 00000013.00000002.3197838373.0000000008CAC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://staygeraldine.nz |
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB4F5000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore6 |
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB520000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore6lBsq |
Source: powershell.exe, 00000002.00000002.2992946262.000001C2F36FF000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://go.microsoft.coB |
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com |
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.comF |
Source: wscript.exe, 00000000.00000002.1866551280.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863180766.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.comMicrosoft |
Source: wscript.exe, 00000000.00000003.1863180766.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/ |
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/_J- |
Source: wscript.exe, 0000000B.00000003.2500368226.0000000004A60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2514719688.0000000004A63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/KiV |
Source: wscript.exe, 0000000B.00000003.2485015419.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2496676071.0000000005053000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515249754.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487806750.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A3B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500423077.0000000004A5C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/KiVfSXMq |
Source: wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/KiVfSXMq( |
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/KiVfSXMqB |
Source: wscript.exe, 0000000B.00000003.2486858229.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A63000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/KiVy |
Source: wscript.exe, 0000000C.00000003.2510118820.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510251662.0000000004F6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2515804100.0000000004F72000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510320972.0000000004F72000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/eEY |
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489300119.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2486802582.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2516344229.0000000005788000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2506338319.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489442883.0000000004F4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2493350153.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514758690.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2509233169.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510118820.0000000004F51000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/eEY9exCe |
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514758690.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2509233169.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/eEY9exCerY |
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/eEY9exCeu |
Source: wscript.exe, 0000000C.00000003.2493350153.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2487222391.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489442883.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/eEYi |
Source: wscript.exe, 00000000.00000002.1866517354.000001C3F5F61000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/zQdp8jhj |
Source: wscript.exe, 00000000.00000002.1866453647.000001C3F5F10000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/zQdp8jhjJ |
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/v |
Source: powershell.exe, 00000013.00000002.3197838373.0000000008B21000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://staygeraldine.nz |
Source: powershell.exe, 00000013.00000002.3197838373.0000000008B21000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://staygeraldine.nz/cs/reccc.txt |
Source: powershell.exe, 00000013.00000002.2685682373.0000000005472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.0000000004B22000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://uploaddeimagens.com.br |
Source: powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49742 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49741 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49740 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49741 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49748 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49751 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49753 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49755 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49755 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49732 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49754 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49753 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49732 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49752 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49751 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49750 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49740 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49742 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49747 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49752 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49750 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49748 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49754 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49747 |