Windows Analysis Report
3SBlY301oa.exe

Overview

General Information

Sample name: 3SBlY301oa.exe
renamed because original name is a hash value
Original sample name: b1027ba8039c64d6887daa9ef2f97438ebfa2f6877e2158680c01b326bdc76c9.exe
Analysis ID: 1465372
MD5: f5b72b219b9dc802075066951e0f5aad
SHA1: 5d475b00153f3bd0d16010ebd5c5aba656455552
SHA256: b1027ba8039c64d6887daa9ef2f97438ebfa2f6877e2158680c01b326bdc76c9
Tags: AsyncRATexe
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: rwanco.duckdns.org Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["rwanco.duckdns.org"], "Port": "1556", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}
Multi AV Scanner detection for submitted file
Source: 3SBlY301oa.exe ReversingLabs: Detection: 71%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 3SBlY301oa.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack String decryptor: rwanco.duckdns.org
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack String decryptor: 1556
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack String decryptor: <123456789>
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack String decryptor: <Xwormmm>
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack String decryptor: USB.exe

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Source: 3SBlY301oa.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: jsc.pdb source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source: Binary string: jsc.pdb8 source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source: Binary string: mscorlib.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBDF.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdb source: WERBDF.tmp.dmp.7.dr

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.7:49743 -> 78.159.112.6:1556
Source: Traffic Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.7:49756 -> 78.159.112.6:1556
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: rwanco.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: rwanco.duckdns.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49716 -> 78.159.112.6:1556
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LEASEWEB-DE-FRA-10DE LEASEWEB-DE-FRA-10DE
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: rwanco.duckdns.org
Source: powershell.exe, 0000000F.00000002.1451228175.00000000032AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mi
Source: powershell.exe, 00000009.00000002.1394565515.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1427775848.0000000005CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.1387360288.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: jsc.exe, 00000003.00000002.3790232304.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1387360288.0000000004C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1387360288.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.7.dr String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000F.00000002.1475019979.0000000007A82000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000009.00000002.1387360288.0000000004C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000C.00000002.1420206040.000000000546C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000002.1482953682.0000000008993000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.micros
Source: powershell.exe, 00000009.00000002.1394565515.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1427775848.0000000005CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB79E48D 1_2_00007FFAAB79E48D
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A4BBE 1_2_00007FFAAB7A4BBE
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB79BBA9 1_2_00007FFAAB79BBA9
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB791988 1_2_00007FFAAB791988
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB79418C 1_2_00007FFAAB79418C
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB798728 1_2_00007FFAAB798728
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB798720 1_2_00007FFAAB798720
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB79143D 1_2_00007FFAAB79143D
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A4C7D 1_2_00007FFAAB7A4C7D
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A4C0B 1_2_00007FFAAB7A4C0B
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A034F 1_2_00007FFAAB7A034F
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A81D4 1_2_00007FFAAB7A81D4
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB860055 1_2_00007FFAAB860055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Code function: 3_2_02A54FA0 3_2_02A54FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Code function: 3_2_02A51918 3_2_02A51918
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049CB480 9_2_049CB480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049CB470 9_2_049CB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_089C3AA8 9_2_089C3AA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_049AB498 12_2_049AB498
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_049AB488 12_2_049AB488
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_089B3AA8 12_2_089B3AA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D8B4A0 15_2_04D8B4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D8B490 15_2_04D8B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_08E03AA8 15_2_08E03AA8
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 20_2_04B4012C 20_2_04B4012C
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 20_2_04B4010C 20_2_04B4010C
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 20_2_04B40FE0 20_2_04B40FE0
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 20_2_04B40812 20_2_04B40812
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C4010C 22_2_04C4010C
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C4012C 22_2_04C4012C
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C40FE0 22_2_04C40FE0
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C400FF 22_2_04C400FF
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C400BA 22_2_04C400BA
Source: C:\Users\user\AppData\Roaming\jsc.exe Code function: 22_2_04C40812 22_2_04C40812
One or more processes crash
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7544 -s 1000
PE file does not import any functions
Source: 3SBlY301oa.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF5E0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000000.1324102706.000001A9BD5C2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameEpebujokeha6 vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXClient.exe4 vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1551373572.000001A9D7910000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe Binary or memory string: OriginalFilenameEpebujokeha6 vs 3SBlY301oa.exe
Yara signature match
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs Base64 encoded string: 'NMBNdRmEgZ18WLKJTdAgUfFC7j2YUzFOghfraQJBkuoyJk1PGzmlF3zxy36h', 'Hd0YTG4GoOyEG4upKrGIqQqg0AZiLD2F5DmQggE42eXXCDnu0HtaASjXLN2DqpZ6Sr8xKxKC3vzqmAAjte2PhOTGrQPW', 'NK337S3Czh7hkGtpmNUM6KELttMJUKWieLm15gOG1EqaDwln2vSbNSnC7Ir5cuVjYyzGz7MTRVT3FkW6Z2dcRgSgg2xL', 'piKrxtHg9mQKF4dFNXCUwVqC0paMFxqv3ANVUJe4bAk1kYvmYjWmaSLoFs30Rj5IeKsmpJhPXiGbtdwmEdZr3ChojZcP', 'nUWZbRcrT7pXjVsBIPPjFoyT28FfMAjZ6EmdIxWO4c3knAvEmtF5qp03BiSgs28sDlOJKludGpcTJBEwh8siFeRpHRkY', 'sqKSh0jNV75kv8Yh7sv5nCeP1WHQZ38b0cbI63gQhwX8BzvXUMJ4RvZ5GSoSRUQVUdHnQ1K2zYqeEux0tOC2NmtIVNTD', 'pIpv79YF9AF1jfcBNAubb02wADjd8PyugmFtFDsUOOLtf8OkANGQxsX43XH4kPlEdZzUQidUGgioHtt805xz0Hw98sSk', 'ufz4uF6B2bBvfyH0wUAGE4hZasZy2uLd6yUKjnPPeyhfrndHX1WOAh3UC84PZZItEoEOponVRFMYdviz5dAgw4okGv1s', 'm7SXw5Tu5rd3MfTBqZuDPv5vk5iwi9fi8ugWbGgm9CDwoexHndJQPEPtZ5J7J05wiOtRJYlwYIX4kmnu2iHcp6NY1gtP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Base64 encoded string: 'z4QBANY1R3KvIto7KzFIkBoa4F3WKES1BnwN9eB6z58JGjxOP8SMO0OQQIjI', 'zKN23bJk4Z6NXjBtAPN5cQ4d86PaZ5Y61SEzvu1YVOgoMSuJVGRDFv16T4Ka', 'jh18L6GtPSYuzieEDBpVYE0vkTKyLETGgqkOCyWBFJ1vaezUMGmydECarc5b', 'hsodfulKFuS2FD19ePK49qCalEK4gxi7Y44WTs1LjAtm2sZJrD5V055UYyeQ', 'G5o2v3v9aWbj3MHVNP0DU2xev9Wx0fgtTrEhebmwRzGGUZE5DfUUdxoIEeS4', 'mTqemR2oMRDteBRmmfDl4tTCe8CVYZO8VDzeI6uq6H4jOKS2Wx2ybmqpgygz', 'GkJDRhUynJQFhxiS60clK5gnV2xe6pMap2pMxgMRa0vzbigOibkLBKs7wc2K', 'zNHWSL9xIu5YygS2pZoRMTjxMleL4l4RWIDuXWwcce7K69oujrxqlGI5r5Bh'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs Base64 encoded string: 'j0qmG2jSe7TsvqRtZgboTdxIqwOAF0Y3JHBmv1GVRxDwReE7MEGF3UjnfDL1nGlqhRQS5NRhZU5i0qs0erhd73oZ2bPv'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs Base64 encoded string: 'JBmtTW9n88bW72y68aqzvZZ0C3Lj0uKdLnCsXRxElX3p5zvjQUNF8niKhhP0'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs Base64 encoded string: 'NMBNdRmEgZ18WLKJTdAgUfFC7j2YUzFOghfraQJBkuoyJk1PGzmlF3zxy36h', 'Hd0YTG4GoOyEG4upKrGIqQqg0AZiLD2F5DmQggE42eXXCDnu0HtaASjXLN2DqpZ6Sr8xKxKC3vzqmAAjte2PhOTGrQPW', 'NK337S3Czh7hkGtpmNUM6KELttMJUKWieLm15gOG1EqaDwln2vSbNSnC7Ir5cuVjYyzGz7MTRVT3FkW6Z2dcRgSgg2xL', 'piKrxtHg9mQKF4dFNXCUwVqC0paMFxqv3ANVUJe4bAk1kYvmYjWmaSLoFs30Rj5IeKsmpJhPXiGbtdwmEdZr3ChojZcP', 'nUWZbRcrT7pXjVsBIPPjFoyT28FfMAjZ6EmdIxWO4c3knAvEmtF5qp03BiSgs28sDlOJKludGpcTJBEwh8siFeRpHRkY', 'sqKSh0jNV75kv8Yh7sv5nCeP1WHQZ38b0cbI63gQhwX8BzvXUMJ4RvZ5GSoSRUQVUdHnQ1K2zYqeEux0tOC2NmtIVNTD', 'pIpv79YF9AF1jfcBNAubb02wADjd8PyugmFtFDsUOOLtf8OkANGQxsX43XH4kPlEdZzUQidUGgioHtt805xz0Hw98sSk', 'ufz4uF6B2bBvfyH0wUAGE4hZasZy2uLd6yUKjnPPeyhfrndHX1WOAh3UC84PZZItEoEOponVRFMYdviz5dAgw4okGv1s', 'm7SXw5Tu5rd3MfTBqZuDPv5vk5iwi9fi8ugWbGgm9CDwoexHndJQPEPtZ5J7J05wiOtRJYlwYIX4kmnu2iHcp6NY1gtP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Base64 encoded string: 'z4QBANY1R3KvIto7KzFIkBoa4F3WKES1BnwN9eB6z58JGjxOP8SMO0OQQIjI', 'zKN23bJk4Z6NXjBtAPN5cQ4d86PaZ5Y61SEzvu1YVOgoMSuJVGRDFv16T4Ka', 'jh18L6GtPSYuzieEDBpVYE0vkTKyLETGgqkOCyWBFJ1vaezUMGmydECarc5b', 'hsodfulKFuS2FD19ePK49qCalEK4gxi7Y44WTs1LjAtm2sZJrD5V055UYyeQ', 'G5o2v3v9aWbj3MHVNP0DU2xev9Wx0fgtTrEhebmwRzGGUZE5DfUUdxoIEeS4', 'mTqemR2oMRDteBRmmfDl4tTCe8CVYZO8VDzeI6uq6H4jOKS2Wx2ybmqpgygz', 'GkJDRhUynJQFhxiS60clK5gnV2xe6pMap2pMxgMRa0vzbigOibkLBKs7wc2K', 'zNHWSL9xIu5YygS2pZoRMTjxMleL4l4RWIDuXWwcce7K69oujrxqlGI5r5Bh'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs Base64 encoded string: 'j0qmG2jSe7TsvqRtZgboTdxIqwOAF0Y3JHBmv1GVRxDwReE7MEGF3UjnfDL1nGlqhRQS5NRhZU5i0qs0erhd73oZ2bPv'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs Base64 encoded string: 'JBmtTW9n88bW72y68aqzvZZ0C3Lj0uKdLnCsXRxElX3p5zvjQUNF8niKhhP0'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.expl.evad.winEXE@19/24@4/1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File created: C:\Users\user\AppData\Roaming\jsc.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Users\user\AppData\Roaming\jsc.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2384:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Mutant created: \Sessions\1\BaseNamedObjects\VeR72e1DfqWDLw8O
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2352:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File created: C:\Users\user\AppData\Local\Temp\Log.tmp Jump to behavior
Source: 3SBlY301oa.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 3SBlY301oa.exe ReversingLabs: Detection: 71%
Source: C:\Users\user\Desktop\3SBlY301oa.exe File read: C:\Users\user\Desktop\3SBlY301oa.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\3SBlY301oa.exe "C:\Users\user\Desktop\3SBlY301oa.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7544 -s 1000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\jsc.exe "C:\Users\user\AppData\Roaming\jsc.exe"
Source: C:\Users\user\AppData\Roaming\jsc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\jsc.exe "C:\Users\user\AppData\Roaming\jsc.exe"
Source: C:\Users\user\AppData\Roaming\jsc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe' Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\3SBlY301oa.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: jsc.lnk.3.dr LNK file: ..\..\..\..\..\jsc.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\3SBlY301oa.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: 3SBlY301oa.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 3SBlY301oa.exe Static file information: File size 1974292 > 1048576
Source: 3SBlY301oa.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 3SBlY301oa.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: jsc.pdb source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: mscorlib.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source: Binary string: jsc.pdb8 source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source: Binary string: mscorlib.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBDF.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDF.tmp.dmp.7.dr
Source: Binary string: System.Core.ni.pdb source: WERBDF.tmp.dmp.7.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.PJ4yIh8L4QL9KfjDPBR6mAV60ZYnHV3mntp4Y5CT7Hegjo7uutBTlJogDJtOghyns2fHGbpWGcVw2m9ZEiwSdM9,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.QKZ0Ck2mWlkLyMBlUtXjO3hfRKiRlLeaOmD52QkKewi5zUw6QBgzxWEFQTBwW6z63ocKhcs4vHbeShFtGzggfKf,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.uTsTqSQAO2Qg6WmIOqht24LLvyXr7Zs4I6TaR29pHK0FxT3cUhnPRy1XwR5OhckyxbCOsgZmIiKun6eFbyZlRwk,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.YgxWVA05MO4ZL3gv0885DgK4HlWMcsgpWkiLrldxSWExGtQNBLmtr44EqreHCmpuYZOAMKWVD0HgKtUHLfUQ48G,uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.XyiV68Uo1k4lXpfRGu52kQhEX2VANGAJ0zRwXTc83B91HDOZNt()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2],uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm._1GhP4YFOCKZGi4WVrIfAPVJVUpnOcxMFjSpkHIye01cn7PRzKL2FXygpGNvZVFrRicaolt11Wqr4ZDP3tR(uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn(HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.PJ4yIh8L4QL9KfjDPBR6mAV60ZYnHV3mntp4Y5CT7Hegjo7uutBTlJogDJtOghyns2fHGbpWGcVw2m9ZEiwSdM9,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.QKZ0Ck2mWlkLyMBlUtXjO3hfRKiRlLeaOmD52QkKewi5zUw6QBgzxWEFQTBwW6z63ocKhcs4vHbeShFtGzggfKf,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.uTsTqSQAO2Qg6WmIOqht24LLvyXr7Zs4I6TaR29pHK0FxT3cUhnPRy1XwR5OhckyxbCOsgZmIiKun6eFbyZlRwk,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.YgxWVA05MO4ZL3gv0885DgK4HlWMcsgpWkiLrldxSWExGtQNBLmtr44EqreHCmpuYZOAMKWVD0HgKtUHLfUQ48G,uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.XyiV68Uo1k4lXpfRGu52kQhEX2VANGAJ0zRwXTc83B91HDOZNt()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2],uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm._1GhP4YFOCKZGi4WVrIfAPVJVUpnOcxMFjSpkHIye01cn7PRzKL2FXygpGNvZVFrRicaolt11Wqr4ZDP3tR(uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn(HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: IMs7q0DloNNoDQRAsyZKCN0CtByg948u System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: IMs7q0DloNNoDQRAsyZKCN0CtByg948u System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs .Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ
Binary contains a suspicious time stamp
Source: 3SBlY301oa.exe Static PE information: 0x9B9359DD [Mon Sep 16 18:47:57 2052 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB7A5C7F push cs; retf 1_2_00007FFAAB7A5C80
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB797963 push ebx; retf 1_2_00007FFAAB79796A
Source: C:\Users\user\Desktop\3SBlY301oa.exe Code function: 1_2_00007FFAAB860055 push esp; retf 4810h 1_2_00007FFAAB860312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049C635D push eax; ret 9_2_049C6371
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049C2D09 push 04B80792h; retf 9_2_049C2D0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049C3AA8 push ebx; retf 9_2_049C3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_049C3A63 push ebx; retf 9_2_049C3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_089C7408 push eax; retf 9_2_089C7409
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_049A42BD push ebx; ret 12_2_049A42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_049A635D push eax; ret 12_2_049A6371
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_089B74B0 push esp; ret 12_2_089B74B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D850E7 pushfd ; retf 0008h 15_2_04D85092
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D842EB push esi; retf 0008h 15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D842A8 push esi; retf 0008h 15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D873C0 pushfd ; retf 0008h 15_2_04D873D9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D84347 push esi; retf 0008h 15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 15_2_04D86377 push eax; ret 15_2_04D86381
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, hnx6gUrEdLQrZkHVbuR3ysbr53WS710OBdOIkG5FDwALkL6YfHbGqIX9XCBl3Z45cvNhJ0UAqRKkJ2ASGu.cs High entropy of concatenated method names: 'MCn27tSY8m8i0mQ9jTbjuVHKaSgqYhUkRjSHBdcOkYFlg8Wn9mswDqq3K0PFYlmjHGHg8Up9W1mNx05qf6', 'SNOu6jVft9cVYusd2OUL7FeVgDXjQDIxPjC3exdlIEB32VAaU2uceEwamxZLiJnc1O5qWbeNMlzS46YzU4', '_4JkXxspwrShWYOu8EqloypdaBacXKoohL2KKLq1fj1TYvJW5ytBCivHnUpzIni2aNrZhaW5ZGzqmJ7j3Oh', 'NgBa3eHghoFV7qHrsS2VrAKDnKPi2vLBU86CKvgUwGabTvVFwU0gRkAldtJQ0Fckajx1hA6fQClYg', 'gTOW2jvgUcMv1GDuUzTHZYm94k8mdVx9epxdwrnpFKkJLIgAAIjaKZxsKRa1QeZkRs3lqLorR9YMD', 't4f0jWe5oCErz0xtT2VvAuPGesSz51jNAQuTfAunHCxCmoghpMAVX6VDcDI76zFN5OQFmzRwHy2nE', 'xW6GDhLRfdRzhjPNsesQzpmMlYvAntWk8TsmBn8EEei0LXygethQiBAJknCqMGe0CvpFabzxEATEb', 'HarFJk2ViRXGJqoKYokpIAUFmTVTVSVoqG6q0', '_2vqhNDxcS7WhtxYQgeVn866eHi14fsLrqukVP', 'P4wEPP6H9xEoxZLsNnbgYphv0lli04jh4JjZx'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.cs High entropy of concatenated method names: 'NpcKyY8maoDwxlvcxcRVIup0lIXmeyH8kKiaYCT7aOD6VENYPDCdnSr03QmpxhZCVORzTPqi6c', 'zNMrRdE72TFU2RTnon79VMKhD0b6suqoJ168BDeXUMb3i3NDFQANGwDRmBA3Zo6Fqg4pWktyVw', '_2mLODVkjd3B1ofUY7GLtrEci3PBJ75leQzdHDZb0AEKH00BkImIuSIfM9Sd2nOhwO6BmSEM7PE', 'lSFXiHexEfWlc5Do0v38QCSODXKS5k7smjtpIl0WY9n25PtCDS8wFzzofFkThkpW3896hViUHy'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, ziDLcACXS24cqvyk8UjuSVl0BmE3QkTHg2wMRgvLFj7j9UoOwICcfMi.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'NeHBY7TkxjG1RCnXCeDrkD20fbRLC1rHkE1qZ5kLjkAeGfayjcMGvRlXuZFZg3wsMRepF2Mq0q', 'ynQ4ziIAtnOen2LlhJhRQfSn0QKylkYDJJYFGS6rpROr1ArgXI13qYnCGddAkv4RYWGv52s0Uf', '_10zWt7BkXnaSCItxDFQSP3yZuRi3BaQLq5gwhZM2sHc0yu87IVYAEEHwSU4IqEV0785FewBk3L', 'ERbwvm66yYI2Sc15rniGKXTjT0THCaKzC9mI2TuSfRPgVErFf2gpmdTUbnuQSPfLzlaNegrQHd'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, opnSQ24XL3OilMgfvlfjrC55vSwvR2OJeC4V70NlscRy30DujE.cs High entropy of concatenated method names: '_1zFkoXKWjWZwJsCT5rL5aqsSge9yRTYw6LnIvFSX3J8Goq5a5Q', 'oOgaruf1KfKOKkywa41JL2m6f2OLZk1fDsny9bEyqsnLqsdI6L', 'Cx4abq6DZqTgeNMz0s5sbOb2x52lJufNPyVBjpXObFziHX3Aqc', 'zrpkx8NbIjtYvf9yoYFmfJ4OkasFMD96zv938UNWkvz5o1X7qV', 'THO2At7ZUJww27YnL9S4NlDYenjLyJod3uAyYdKtFVKiWSHpp254fZk5mrGUIQTCl9vYszDgvvYC5', 'LSnEzCBEZHcSHm4ZYh5qJQ1hXnJpL7DaEkOpVZipoG5oMGdhXBz99qoohk8L4nctuvqVhlBPj5mGk', 'e7GEWK0cRm1YuJs3Xumxe8XU3OLtweGqf6qkKs1GEuKTzlW4bRir3PRNFWBsUaao39bZfplthXwIR', 'AkLkHpJQe693l2V71MmRrUjjcYrKfrvxTXmQXKHLAaiu5BtjlPpZDGtJNrShOgtn9VB8lQnJ4fNTt', 'g9Fxq7yl15MqJtxsouW9iKw6YzvLNubMXWXXuDqqHxml9kD1Ua32y3xfxTP47MjYSaThTVDD1xFcv', 'QRmTMeAUia2a1Nxaq6vsi1YFQmfCOpMddzKDtqq85835m3ROZm4avt5TRdfbjIEqu7d0ddPKuY1g2'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs High entropy of concatenated method names: 'M1c8kiFJbUucucXjaSnfR2nLtPbob09f', 'IMs7q0DloNNoDQRAsyZKCN0CtByg948u', '_7WlRwYCHYBkfE8xwvXDlTPA18YwlHjPk', 'viVHj9d18IScWXsSZQVpgM57FOAQMiDaiWXY2DHoLIuhIh5lwqQahsni0xWz0JD9I', 'hxwwKIciyA4398u8fCK3TuZ9Qo8G6LVrZFx6myx9VfrlE4JL9oExiPiHasnRzSmIj', 'lnPBBZ1bE6cabQay4bBQ2mVezXFzHJg8ZwLf8pX2d6KZ2KmD2ip2DZ8QtA9F6J4Vt', 'iMLJNkAXhSI4cEx6LH5k85VySJ0AVw1Wv6sEGys30BiNiqlYJQGXvejpvVYjiWgOA', '_4NZruWJbryAceex8RUEmqAdwrqJqIUiwVdDU7oFBxp4nAj6TySF7b798EdkFIq814', 'Pz5cl33t9AmOg6l8qmz2QqmffBnN9lviHcYrVqF4hHzhe1buUIo4RZ346VkIYPQY4', 'QBwydCqZT0CJE7vmBfKbW88M1QLiT5YXsab84lSIg6InLLFC4iwR13zhBiUcEcAjP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs High entropy of concatenated method names: 'xIFmamIjxhcygeweRYzJpUfWUuxDESo9nGundshRochQYWakwnk638xR3QxiEerulhGOMdygd5V2KMt5z7SN9Y9', '_6CAhVxC5c5QbKaHb88vJ7HkVXLgbSndC3Bs3rkezT3927CBbvLQ5Q6ALrtLnApfgVLDJasiVQ', 'GRf7qpJUcaF2b4rDtewcJcxzWT1CWpfLuhXLdRCcSXWw9gk0tjvqISDn5z0KlcjogMs5OrRfn', 'mcItlcj118Dv5eqSN5T1i5AystGQV5MN6OZNLOGReA273eaZJ88ykqB5RhC14HgbWCMJgryTE', 'mspEGkObkL0q867onyNhWyTdS656vnhSVSpuGCS60n16OuVwnNVJilWKN8notipzctbiWH9zg', '_9IU6fSrmj55rdN06f5wjRpAwOXdt4RFZ8BJZH47Prsf6yJ5JW6ZPoFgXO6Fwwf3LXmYSYXZ8R', 'mEaik3EQhEou0DDJYG0K2rVdzZNxUfNobBVeQLrssHX59cZGd9hac82RJgMmCj7uby61AKIy1', '_2hw28fS9fiBfck11JSG7DTR30afaAoGGUUosPbdlKyRpvSaklAaaLUaudrAUfxsM5M7HEz9L8', '_2Uaqoj33codsDT4svZAcrwPbKAKNJm1jsxOkjg3O6QESflU4US4xoXyjm5nCWlbwym5mkbS8L', 'MkfQjLexxJ4Y5MbQ8yYK7FuaIzckm96gZI1HXbsBwo8WRNjtdxL0iE4Fg6CzmCywjI1fLtS7u'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs High entropy of concatenated method names: 'cyF4dBrRKO7yi6ED1RXvUwsYPyvjMzWwAXUfbsEK6WhKyyzddB3MV1WW6UkteyZjM', 'x2ExmQI9jwo0dxRr1CcTdIrzciqAWfMKEI1XTncDjm9ZMCCV41Tt6chqWXOAWaK5MHraIuUqgYnR8VdemAOAQFO324QC', 'go6ktPSHlSt168oO2OfgAiFnUgGLEb6nzXlM8hFJDiVWbK3qyaXRlqGrtUcdmmgEiMzg9L2PX9NG8', 'T9jL2uggett9kBTiRhu3YLvzwHJ9GEUZify4mqyzSycUjDn1LtKJdlVUwFrZPSgeGqGnQ4RbauC79', 'HicLbQMe9mKgqTbKmzgtX7Ax6qBdnyY6chfIe6SDH9qlsj9BfgwSj1gVo36Bfnzj5LzOkU8JXlYbP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs High entropy of concatenated method names: 'wcfrJVluv3OS7yUY36HHEOEb3KIiEC3tePn2gDp886Cp1mw4DK', '_6gMZvqFuMJTFoBplDUK8mFGdtcesKwT1P1HkwzQG9b4p1UyylG', 'UNFgPUvNX7lJ21brhgt98hYwhdf6gk6mtZnKLUVZh9Vk3bAWf9', '_9SOzBfeG8MGTEJgUzN9DtpvO6oYoyVMb5utGz99MVIOXuaOVsKWWjxjkPcgOnRTgATahKUy1pezK2', 'HglCyM4Jg53pqX902L2a5IOSdwEyCE7vqg2Y8uNWN5pTSvhVFYZKX4XsXKjSRQxlaKqog7hzaTc9T', 'qYJe3i18rPj9gib7P8z65HgFG9DNP2sYJS4nUFWICITEa3rthmonrzq3nvsmTaYOteWFh8h77HGwy', 'FqzhCIIAomJZSSM4j8tfEuBxyEjWWpfOAxSVrXgtGTCilAil8UZAOg9d1QiYlZBWFwq2YBAGf1WCv', 'bzt659amT8V3PZ8xfL4XUeUaT8yBBzxMz4j0b7cOjwp63MQyclttcGgPDy7xKzlZ2ZpXco5ztBZip', '_6eqWmqnW4oQf7GnCqoZgLaxXdgCfosvWAurXTAkDEQyj1ocSMBVEH3HsU4Dd60eJWcdqVxakPrQzK', '_5f72odwL6IfroqBRVAibV5aXok16O5QtWwkt7PajH9t6ucPwSzDRmq9JsJttWVCxdQSSNNhqqmtIB'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs High entropy of concatenated method names: 'IqCY5ARkNOvWyqqjvLsY5SbFsxdTHwZxfPSmxYkVCyfhCki8aw', 'K5rKr2zgNMyDsGKQwrE6mTuIfaT3xADZiC0B1OrM46gGt9HqeD', 'VPpDPIotu6pMH1Cs8mGfYkCq28yFcglBfT4hNqV81b9y2lR1jo', 'M9k9ko3eSQ4rK1i8vAJX1QLwoiiXd5AJginNuiz61pokGFQ8TW', 'm7XyOM43gO65utKMRRHxHBAVbwtkNIFUlAZwJ2xwlaSYhEWvjZ', 'ITaGyHzq9WHYJfuo5IdindCbGEMf5inZkp2XLDs3r5w9eonL84', 'bIPZ4nieEwHFLMBHuq7hvJ3BpSQuo7d8sR4GF27uAmacBjbv9Q', 'XOeiLNyUXueNYW3zzG2nvo0eJdPJDHtByX2gJMf3HRkjalox7g', 'DRUGSg0piHSn38oBZXNYdRLixptxsvtAisO0JIJ5aVtIJR6GbO', 'EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Kgn0Nl0cIVemHWKGRa2fKZarKOln46ySB1LQfPpw5mm9bvx1kkun9MhJghfZQsiZK.cs High entropy of concatenated method names: 'ZXg0uSo4FTOUnE2WSjicvZslQk2lqtORPWQvrK4WuHvONDHc54Fy4EpnxnwRaOc0f', 'ljt5YwntiiKZBAoYd8kMEwFFUNVakzSb6liLBUQkUIkGlZdWra5buYOs1HCtLKSwf', 'SPgB8y2Y6yiy1BmeNENfU31S2iqtBI3MHnHvVZfxjwLMaSiPUv', 'GJeyvC7H1k0VVI1MZSiEO1WXmSQGOzmXYKY4XabJOL9svwy9Wh', '_7U79M5KPcHdMepvALfjVXxWspOqB8Im5gLJzJhPAnvFLhNYEOu', '_5MPTmxWNCFXDgxsi2y37uQlb3jjFH7a5LwKqz0dQAkKYXHzzYW', 'dHeeJ2G6Pxbsw2nv1SMDv2orMUWs5Fbi9gyoyf6Ku0jXATtWlH', '_5mnCGT5mmv3A97bE54cNurisrN4A8HgMRLI84IxlvcpGarEh1p', '_0LXlGLbPdLQUcSJF5A9UejYoHCH8qWvx2UveVDzjlDEkBadKrL', 'fWWPhBTguISksjCVEg4pVoab1AOw1DUWi4OaFRcQMLHS39K0Ob'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs High entropy of concatenated method names: 'DKZt1Nmba5mu3gym5xqSWDbmChbpLhNf2cE1EL0Z2KtdUApJ40Vk5JELfW0kvUKZeTIucfJQqFMZAjvcPT02b1g', 'BC9oN1P8z9pfs2GnQEIhckIAXU1sYzGI6F0FqTW9cBCJG1gmTjCccMDn5sCxqI1XujSNM8pBTUmEYTk075oNzNg', 'M6o1H8i9q41o0dzUkzzSsWPR22F2kTKdWIXhxxD3o5nGmdTbgZguKnUOihYBpn0HRmtxSDESLf9GHMsYAUdM752', 'ePUOuxnIKy5gCP68dUdcI7mP96EzI0CHLbWpKwOVaJmguj0sKr8aybGqdALgVDHQ001doHiycKpq57E3J5GkHYp', 'KeaAToFHIO8SNmEILop6uCUoEKFSRWMci0jQZXIy9s4Ri5jMpZNC6VW70S5uWu9nZUZgbpmvp4BUwUd2ghTBHbk', 'UOgQIHadJlEWVfg2Wch0gX96asCCW0dhmwuYrUnR5Fg1riIAYReqrhzky0XNUZ09sxQh8eaYhO', 'gkxn8bi7xQYmqFjNnzFygK3JoBYajNty0140aZTz5QpnMRXPYJHw7lsEDPTIQvVwOwh9GfY25s', 'uUhqZ3uwUhvvmhdXwCTOcoPPpnknCwqgFJ56JjIefDAtOlUp0gn0E3DliLjQeYHQHY4FFJemZw', '_1mj0tZFCwTP3OLSNzUIUp49foiTDOeJLgq5uY2BCw1avlHSbONq8wkSPQ7wbUflB4pte70LUZp', 'JlvyOS4ZlISKoEMVsQH2HCJmLG4CuLphSGG7NWAhp6tSuzNstEB3DNmNbQgkG7GcUKluGMV6Zn'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, hnx6gUrEdLQrZkHVbuR3ysbr53WS710OBdOIkG5FDwALkL6YfHbGqIX9XCBl3Z45cvNhJ0UAqRKkJ2ASGu.cs High entropy of concatenated method names: 'MCn27tSY8m8i0mQ9jTbjuVHKaSgqYhUkRjSHBdcOkYFlg8Wn9mswDqq3K0PFYlmjHGHg8Up9W1mNx05qf6', 'SNOu6jVft9cVYusd2OUL7FeVgDXjQDIxPjC3exdlIEB32VAaU2uceEwamxZLiJnc1O5qWbeNMlzS46YzU4', '_4JkXxspwrShWYOu8EqloypdaBacXKoohL2KKLq1fj1TYvJW5ytBCivHnUpzIni2aNrZhaW5ZGzqmJ7j3Oh', 'NgBa3eHghoFV7qHrsS2VrAKDnKPi2vLBU86CKvgUwGabTvVFwU0gRkAldtJQ0Fckajx1hA6fQClYg', 'gTOW2jvgUcMv1GDuUzTHZYm94k8mdVx9epxdwrnpFKkJLIgAAIjaKZxsKRa1QeZkRs3lqLorR9YMD', 't4f0jWe5oCErz0xtT2VvAuPGesSz51jNAQuTfAunHCxCmoghpMAVX6VDcDI76zFN5OQFmzRwHy2nE', 'xW6GDhLRfdRzhjPNsesQzpmMlYvAntWk8TsmBn8EEei0LXygethQiBAJknCqMGe0CvpFabzxEATEb', 'HarFJk2ViRXGJqoKYokpIAUFmTVTVSVoqG6q0', '_2vqhNDxcS7WhtxYQgeVn866eHi14fsLrqukVP', 'P4wEPP6H9xEoxZLsNnbgYphv0lli04jh4JjZx'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.cs High entropy of concatenated method names: 'NpcKyY8maoDwxlvcxcRVIup0lIXmeyH8kKiaYCT7aOD6VENYPDCdnSr03QmpxhZCVORzTPqi6c', 'zNMrRdE72TFU2RTnon79VMKhD0b6suqoJ168BDeXUMb3i3NDFQANGwDRmBA3Zo6Fqg4pWktyVw', '_2mLODVkjd3B1ofUY7GLtrEci3PBJ75leQzdHDZb0AEKH00BkImIuSIfM9Sd2nOhwO6BmSEM7PE', 'lSFXiHexEfWlc5Do0v38QCSODXKS5k7smjtpIl0WY9n25PtCDS8wFzzofFkThkpW3896hViUHy'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, ziDLcACXS24cqvyk8UjuSVl0BmE3QkTHg2wMRgvLFj7j9UoOwICcfMi.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'NeHBY7TkxjG1RCnXCeDrkD20fbRLC1rHkE1qZ5kLjkAeGfayjcMGvRlXuZFZg3wsMRepF2Mq0q', 'ynQ4ziIAtnOen2LlhJhRQfSn0QKylkYDJJYFGS6rpROr1ArgXI13qYnCGddAkv4RYWGv52s0Uf', '_10zWt7BkXnaSCItxDFQSP3yZuRi3BaQLq5gwhZM2sHc0yu87IVYAEEHwSU4IqEV0785FewBk3L', 'ERbwvm66yYI2Sc15rniGKXTjT0THCaKzC9mI2TuSfRPgVErFf2gpmdTUbnuQSPfLzlaNegrQHd'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, opnSQ24XL3OilMgfvlfjrC55vSwvR2OJeC4V70NlscRy30DujE.cs High entropy of concatenated method names: '_1zFkoXKWjWZwJsCT5rL5aqsSge9yRTYw6LnIvFSX3J8Goq5a5Q', 'oOgaruf1KfKOKkywa41JL2m6f2OLZk1fDsny9bEyqsnLqsdI6L', 'Cx4abq6DZqTgeNMz0s5sbOb2x52lJufNPyVBjpXObFziHX3Aqc', 'zrpkx8NbIjtYvf9yoYFmfJ4OkasFMD96zv938UNWkvz5o1X7qV', 'THO2At7ZUJww27YnL9S4NlDYenjLyJod3uAyYdKtFVKiWSHpp254fZk5mrGUIQTCl9vYszDgvvYC5', 'LSnEzCBEZHcSHm4ZYh5qJQ1hXnJpL7DaEkOpVZipoG5oMGdhXBz99qoohk8L4nctuvqVhlBPj5mGk', 'e7GEWK0cRm1YuJs3Xumxe8XU3OLtweGqf6qkKs1GEuKTzlW4bRir3PRNFWBsUaao39bZfplthXwIR', 'AkLkHpJQe693l2V71MmRrUjjcYrKfrvxTXmQXKHLAaiu5BtjlPpZDGtJNrShOgtn9VB8lQnJ4fNTt', 'g9Fxq7yl15MqJtxsouW9iKw6YzvLNubMXWXXuDqqHxml9kD1Ua32y3xfxTP47MjYSaThTVDD1xFcv', 'QRmTMeAUia2a1Nxaq6vsi1YFQmfCOpMddzKDtqq85835m3ROZm4avt5TRdfbjIEqu7d0ddPKuY1g2'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs High entropy of concatenated method names: 'M1c8kiFJbUucucXjaSnfR2nLtPbob09f', 'IMs7q0DloNNoDQRAsyZKCN0CtByg948u', '_7WlRwYCHYBkfE8xwvXDlTPA18YwlHjPk', 'viVHj9d18IScWXsSZQVpgM57FOAQMiDaiWXY2DHoLIuhIh5lwqQahsni0xWz0JD9I', 'hxwwKIciyA4398u8fCK3TuZ9Qo8G6LVrZFx6myx9VfrlE4JL9oExiPiHasnRzSmIj', 'lnPBBZ1bE6cabQay4bBQ2mVezXFzHJg8ZwLf8pX2d6KZ2KmD2ip2DZ8QtA9F6J4Vt', 'iMLJNkAXhSI4cEx6LH5k85VySJ0AVw1Wv6sEGys30BiNiqlYJQGXvejpvVYjiWgOA', '_4NZruWJbryAceex8RUEmqAdwrqJqIUiwVdDU7oFBxp4nAj6TySF7b798EdkFIq814', 'Pz5cl33t9AmOg6l8qmz2QqmffBnN9lviHcYrVqF4hHzhe1buUIo4RZ346VkIYPQY4', 'QBwydCqZT0CJE7vmBfKbW88M1QLiT5YXsab84lSIg6InLLFC4iwR13zhBiUcEcAjP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs High entropy of concatenated method names: 'xIFmamIjxhcygeweRYzJpUfWUuxDESo9nGundshRochQYWakwnk638xR3QxiEerulhGOMdygd5V2KMt5z7SN9Y9', '_6CAhVxC5c5QbKaHb88vJ7HkVXLgbSndC3Bs3rkezT3927CBbvLQ5Q6ALrtLnApfgVLDJasiVQ', 'GRf7qpJUcaF2b4rDtewcJcxzWT1CWpfLuhXLdRCcSXWw9gk0tjvqISDn5z0KlcjogMs5OrRfn', 'mcItlcj118Dv5eqSN5T1i5AystGQV5MN6OZNLOGReA273eaZJ88ykqB5RhC14HgbWCMJgryTE', 'mspEGkObkL0q867onyNhWyTdS656vnhSVSpuGCS60n16OuVwnNVJilWKN8notipzctbiWH9zg', '_9IU6fSrmj55rdN06f5wjRpAwOXdt4RFZ8BJZH47Prsf6yJ5JW6ZPoFgXO6Fwwf3LXmYSYXZ8R', 'mEaik3EQhEou0DDJYG0K2rVdzZNxUfNobBVeQLrssHX59cZGd9hac82RJgMmCj7uby61AKIy1', '_2hw28fS9fiBfck11JSG7DTR30afaAoGGUUosPbdlKyRpvSaklAaaLUaudrAUfxsM5M7HEz9L8', '_2Uaqoj33codsDT4svZAcrwPbKAKNJm1jsxOkjg3O6QESflU4US4xoXyjm5nCWlbwym5mkbS8L', 'MkfQjLexxJ4Y5MbQ8yYK7FuaIzckm96gZI1HXbsBwo8WRNjtdxL0iE4Fg6CzmCywjI1fLtS7u'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs High entropy of concatenated method names: 'cyF4dBrRKO7yi6ED1RXvUwsYPyvjMzWwAXUfbsEK6WhKyyzddB3MV1WW6UkteyZjM', 'x2ExmQI9jwo0dxRr1CcTdIrzciqAWfMKEI1XTncDjm9ZMCCV41Tt6chqWXOAWaK5MHraIuUqgYnR8VdemAOAQFO324QC', 'go6ktPSHlSt168oO2OfgAiFnUgGLEb6nzXlM8hFJDiVWbK3qyaXRlqGrtUcdmmgEiMzg9L2PX9NG8', 'T9jL2uggett9kBTiRhu3YLvzwHJ9GEUZify4mqyzSycUjDn1LtKJdlVUwFrZPSgeGqGnQ4RbauC79', 'HicLbQMe9mKgqTbKmzgtX7Ax6qBdnyY6chfIe6SDH9qlsj9BfgwSj1gVo36Bfnzj5LzOkU8JXlYbP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs High entropy of concatenated method names: 'wcfrJVluv3OS7yUY36HHEOEb3KIiEC3tePn2gDp886Cp1mw4DK', '_6gMZvqFuMJTFoBplDUK8mFGdtcesKwT1P1HkwzQG9b4p1UyylG', 'UNFgPUvNX7lJ21brhgt98hYwhdf6gk6mtZnKLUVZh9Vk3bAWf9', '_9SOzBfeG8MGTEJgUzN9DtpvO6oYoyVMb5utGz99MVIOXuaOVsKWWjxjkPcgOnRTgATahKUy1pezK2', 'HglCyM4Jg53pqX902L2a5IOSdwEyCE7vqg2Y8uNWN5pTSvhVFYZKX4XsXKjSRQxlaKqog7hzaTc9T', 'qYJe3i18rPj9gib7P8z65HgFG9DNP2sYJS4nUFWICITEa3rthmonrzq3nvsmTaYOteWFh8h77HGwy', 'FqzhCIIAomJZSSM4j8tfEuBxyEjWWpfOAxSVrXgtGTCilAil8UZAOg9d1QiYlZBWFwq2YBAGf1WCv', 'bzt659amT8V3PZ8xfL4XUeUaT8yBBzxMz4j0b7cOjwp63MQyclttcGgPDy7xKzlZ2ZpXco5ztBZip', '_6eqWmqnW4oQf7GnCqoZgLaxXdgCfosvWAurXTAkDEQyj1ocSMBVEH3HsU4Dd60eJWcdqVxakPrQzK', '_5f72odwL6IfroqBRVAibV5aXok16O5QtWwkt7PajH9t6ucPwSzDRmq9JsJttWVCxdQSSNNhqqmtIB'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs High entropy of concatenated method names: 'IqCY5ARkNOvWyqqjvLsY5SbFsxdTHwZxfPSmxYkVCyfhCki8aw', 'K5rKr2zgNMyDsGKQwrE6mTuIfaT3xADZiC0B1OrM46gGt9HqeD', 'VPpDPIotu6pMH1Cs8mGfYkCq28yFcglBfT4hNqV81b9y2lR1jo', 'M9k9ko3eSQ4rK1i8vAJX1QLwoiiXd5AJginNuiz61pokGFQ8TW', 'm7XyOM43gO65utKMRRHxHBAVbwtkNIFUlAZwJ2xwlaSYhEWvjZ', 'ITaGyHzq9WHYJfuo5IdindCbGEMf5inZkp2XLDs3r5w9eonL84', 'bIPZ4nieEwHFLMBHuq7hvJ3BpSQuo7d8sR4GF27uAmacBjbv9Q', 'XOeiLNyUXueNYW3zzG2nvo0eJdPJDHtByX2gJMf3HRkjalox7g', 'DRUGSg0piHSn38oBZXNYdRLixptxsvtAisO0JIJ5aVtIJR6GbO', 'EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Kgn0Nl0cIVemHWKGRa2fKZarKOln46ySB1LQfPpw5mm9bvx1kkun9MhJghfZQsiZK.cs High entropy of concatenated method names: 'ZXg0uSo4FTOUnE2WSjicvZslQk2lqtORPWQvrK4WuHvONDHc54Fy4EpnxnwRaOc0f', 'ljt5YwntiiKZBAoYd8kMEwFFUNVakzSb6liLBUQkUIkGlZdWra5buYOs1HCtLKSwf', 'SPgB8y2Y6yiy1BmeNENfU31S2iqtBI3MHnHvVZfxjwLMaSiPUv', 'GJeyvC7H1k0VVI1MZSiEO1WXmSQGOzmXYKY4XabJOL9svwy9Wh', '_7U79M5KPcHdMepvALfjVXxWspOqB8Im5gLJzJhPAnvFLhNYEOu', '_5MPTmxWNCFXDgxsi2y37uQlb3jjFH7a5LwKqz0dQAkKYXHzzYW', 'dHeeJ2G6Pxbsw2nv1SMDv2orMUWs5Fbi9gyoyf6Ku0jXATtWlH', '_5mnCGT5mmv3A97bE54cNurisrN4A8HgMRLI84IxlvcpGarEh1p', '_0LXlGLbPdLQUcSJF5A9UejYoHCH8qWvx2UveVDzjlDEkBadKrL', 'fWWPhBTguISksjCVEg4pVoab1AOw1DUWi4OaFRcQMLHS39K0Ob'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs High entropy of concatenated method names: 'DKZt1Nmba5mu3gym5xqSWDbmChbpLhNf2cE1EL0Z2KtdUApJ40Vk5JELfW0kvUKZeTIucfJQqFMZAjvcPT02b1g', 'BC9oN1P8z9pfs2GnQEIhckIAXU1sYzGI6F0FqTW9cBCJG1gmTjCccMDn5sCxqI1XujSNM8pBTUmEYTk075oNzNg', 'M6o1H8i9q41o0dzUkzzSsWPR22F2kTKdWIXhxxD3o5nGmdTbgZguKnUOihYBpn0HRmtxSDESLf9GHMsYAUdM752', 'ePUOuxnIKy5gCP68dUdcI7mP96EzI0CHLbWpKwOVaJmguj0sKr8aybGqdALgVDHQ001doHiycKpq57E3J5GkHYp', 'KeaAToFHIO8SNmEILop6uCUoEKFSRWMci0jQZXIy9s4Ri5jMpZNC6VW70S5uWu9nZUZgbpmvp4BUwUd2ghTBHbk', 'UOgQIHadJlEWVfg2Wch0gX96asCCW0dhmwuYrUnR5Fg1riIAYReqrhzky0XNUZ09sxQh8eaYhO', 'gkxn8bi7xQYmqFjNnzFygK3JoBYajNty0140aZTz5QpnMRXPYJHw7lsEDPTIQvVwOwh9GfY25s', 'uUhqZ3uwUhvvmhdXwCTOcoPPpnknCwqgFJ56JjIefDAtOlUp0gn0E3DliLjQeYHQHY4FFJemZw', '_1mj0tZFCwTP3OLSNzUIUp49foiTDOeJLgq5uY2BCw1avlHSbONq8wkSPQ7wbUflB4pte70LUZp', 'JlvyOS4ZlISKoEMVsQH2HCJmLG4CuLphSGG7NWAhp6tSuzNstEB3DNmNbQgkG7GcUKluGMV6Zn'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File created: C:\Users\user\AppData\Roaming\jsc.exe Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run jsc Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run jsc Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory allocated: 1A9BD8F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory allocated: 1A9D7250000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Memory allocated: 2A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Memory allocated: 2BC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Memory allocated: 4BC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: 2410000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: 2610000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: 2550000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: B00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: 26B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe Memory allocated: 46B0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Window / User API: threadDelayed 2913 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Window / User API: threadDelayed 6881 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5866 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3857 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7634 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1946 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5921 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3878 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 1168 Thread sleep time: -33204139332677172s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8188 Thread sleep count: 7634 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8172 Thread sleep count: 1946 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7232 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332 Thread sleep count: 5921 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332 Thread sleep count: 3878 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 2092 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 2184 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 7996 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 7984 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe Thread delayed: delay time: 922337203685477
Source: Amcache.hve.7.dr Binary or memory string: VMware
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr Binary or memory string: VMware, Inc.
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: jsc.exe, 00000003.00000002.3786253130.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.7.dr Binary or memory string: vmci.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin`
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Amcache.hve.7.dr Binary or memory string: \driver\vmci,\driver\pci
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.7.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 3SBlY301oa.exe, -------.cs Reference to suspicious API methods: GetProcAddress(__0656_FDEE_061A, _06E3_0607_061D_065B)
Source: 3SBlY301oa.exe, -------.cs Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_06D6.Length, 64u, out var _065E_060D_FBC2_FBC9_060B_06E9)
Source: 3SBlY301oa.exe, -------.cs Reference to suspicious API methods: LoadLibrary(_FDE2_FDE4_06DF_06DC_FDEC(_061D_0602_0650_06D6._060A_0607_FDE4))
Adds a directory exclusion to Windows Defender
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe' Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 418000 Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 41A000 Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: B59008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe' Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\3SBlY301oa.exe Queries volume information: C:\Users\user\Desktop\3SBlY301oa.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe Queries volume information: C:\Users\user\AppData\Roaming\jsc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe Queries volume information: C:\Users\user\AppData\Roaming\jsc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\Desktop\3SBlY301oa.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.7.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: jsc.exe, 00000003.00000002.3786253130.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3806247170.0000000006B45000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3786253130.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3786253130.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3806247170.0000000006B20000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jsc.exe PID: 7624, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jsc.exe PID: 7624, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465372 Sample: 3SBlY301oa.exe Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 48 rwanco.duckdns.org 2->48 56 Snort IDS alert for network traffic 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 64 13 other signatures 2->64 9 3SBlY301oa.exe 2 2->9         started        12 jsc.exe 2->12         started        14 jsc.exe 2->14         started        signatures3 62 Uses dynamic DNS services 48->62 process4 signatures5 66 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->66 68 Writes to foreign memory regions 9->68 70 Allocates memory in foreign processes 9->70 72 Injects a PE file into a foreign processes 9->72 16 jsc.exe 1 7 9->16         started        21 WerFault.exe 19 16 9->21         started        23 jsc.exe 9->23         started        25 conhost.exe 12->25         started        27 conhost.exe 14->27         started        process6 dnsIp7 46 rwanco.duckdns.org 78.159.112.6, 1556, 49716, 49719 LEASEWEB-DE-FRA-10DE Germany 16->46 42 C:\Users\user\AppData\Roaming\jsc.exe, PE32 16->42 dropped 50 Protects its processes via BreakOnTermination flag 16->50 52 Bypasses PowerShell execution policy 16->52 54 Adds a directory exclusion to Windows Defender 16->54 29 powershell.exe 23 16->29         started        32 powershell.exe 22 16->32         started        34 powershell.exe 23 16->34         started        44 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->44 dropped file8 signatures9 process10 signatures11 74 Loading BitLocker PowerShell Module 29->74 36 conhost.exe 29->36         started        38 conhost.exe 32->38         started        40 conhost.exe 34->40         started        process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
78.159.112.6
 rwanco.duckdns.org Germany
28753 LEASEWEB-DE-FRA-10DE true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
rwanco.duckdns.org 78.159.112.6 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
rwanco.duckdns.org true
  • Avira URL Cloud: malware
 unknown