Edit tour

Windows Analysis Report
Exploit Locator.exe

Overview

General Information

Sample name:	Exploit Locator.exe
Analysis ID:	1617091
MD5:	ceda66edeec9673d08da4d9e592f175b
SHA1:	7fe94dd7c2439264b1101b3834470293eeca938c
SHA256:	be44f0224d2770e099e468066859580f17ad65c6a9574ed6e4a9e60ece3ca850
Infos:

Detection

PureCrypter

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

.NET source code contains potential unpacker

Allocates memory in foreign processes

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

Exploit Locator.exe (PID: 3556 cmdline: "C:\Users\user\Desktop\Exploit Locator.exe" MD5: CEDA66EDEEC9673D08DA4D9E592F175B)

Exploit Locator.tmp (PID: 7360 cmdline: "C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp" /SL5="$10452,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe" MD5: 058BDB9BC61E879DED0EC01435EB3829)

Exploit Locator.exe (PID: 3644 cmdline: "C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT MD5: CEDA66EDEEC9673D08DA4D9E592F175B)

Exploit Locator.tmp (PID: 1760 cmdline: "C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp" /SL5="$3047E,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT MD5: 058BDB9BC61E879DED0EC01435EB3829)

AutoIt3.exe (PID: 8444 cmdline: "C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe" matriculates.a3x MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8600 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

AutoIt3.exe (PID: 8648 cmdline: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\matriculates.a3x" MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

AutoIt3.exe (PID: 8812 cmdline: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\matriculates.a3x" MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 8600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 8724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\matriculates.a3x", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe, ProcessId: 8444, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\matriculates

Suricata Signatures

ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T14:12:41.843596+0100	2035595	1	Domain Observed Used for C2 Detected	176.65.139.51	56001	192.168.11.20	49769	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Exploit Locator.exe

Virustotal: Detection: 13%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.1% probability

Source: Exploit Locator.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: Exploit Locator.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/Microsoft.VisualStudio.LanguageServices.Implementation/Release/net472/Microsoft.VisualStudio.LanguageServices.Implementation.pdbSHA256 source: is-9J9G5.tmp.4.dr
Source:	Binary string: D:\a\_work\1\s\Intermediate\asan\mt\libomp.nativeproj\objr\amd64\Release\bin\libomp140.x86_64.pdb source: is-1O67P.tmp.4.dr, libomp140.x86_64.dll.5.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNetCore.Mvc.Abstractions/Release/net7.0/Microsoft.AspNetCore.Mvc.Abstractions.pdbSHA256 source: is-27FQL.tmp.4.dr
Source:	Binary string: Microsoft.VisualStudio.ScriptedHost.pdb source: Microsoft.VisualStudio.ScriptedHost.dll.5.dr, is-TVGL8.tmp.4.dr
Source:	Binary string: mshwLatin.pdb source: mshwLatin.dll.5.dr, is-090ED.tmp.4.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNetCore.Mvc.Abstractions/Release/net7.0/Microsoft.AspNetCore.Mvc.Abstractions.pdb source: is-27FQL.tmp.4.dr
Source:	Binary string: mshwLatin.pdbGCTL source: mshwLatin.dll.5.dr, is-090ED.tmp.4.dr
Source:	Binary string: msadomd.pdbGCTL source: is-ADD8T.tmp.4.dr, msadomd.dll.5.dr
Source:	Binary string: msadomd.pdb source: is-ADD8T.tmp.4.dr, msadomd.dll.5.dr
Source:	Binary string: System.CodeDom.ni.pdb source: is-CLFPL.tmp.4.dr, System.CodeDom.dll.5.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualStudio.LanguageServices.Implementation/Release/net472/Microsoft.VisualStudio.LanguageServices.Implementation.pdb source: is-9J9G5.tmp.4.dr
Source:	Binary string: LibGit2Sharp.pdb source: is-2MCT9.tmp.4.dr
Source:	Binary string: H.PDBTH@CZRA#]CH]\'[U Y@3 source: AutoIt3.exe, 00000005.00000003.107676754138.0000000003D0D000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000007.00000003.107779292371.0000000003EE9000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000009.00000003.107860122096.000000000377E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb source: hostpolicy.dll.5.dr, is-FRBPQ.tmp.4.dr
Source:	Binary string: LibGit2Sharp.pdbSHA256IG source: is-2MCT9.tmp.4.dr
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: Exploit Locator.tmp, 00000001.00000003.107387455462.0000000002428000.00000004.00001000.00020000.00000000.sdmp, Exploit Locator.exe, _isdecmp.dll.1.dr
Source:	Binary string: Microsoft.AspNetCore.Mvc.Abstractions.ni.pdb source: is-27FQL.tmp.4.dr
Source:	Binary string: /_/artifacts/obj/System.CodeDom/Release/net7.0/System.CodeDom.pdb source: is-CLFPL.tmp.4.dr, System.CodeDom.dll.5.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert : 176.65.139.51:56001 -> 192.168.11.20:49769

Source: global traffic

TCP traffic: 192.168.11.20:49769 -> 176.65.139.51:56001

Source: Joe Sandbox View

ASN Name: PALTEL-ASPALTELAutonomousSystemPS PALTEL-ASPALTELAutonomousSystemPS

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.139.51

Source: Exploit Locator.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Exploit Locator.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Exploit Locator.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Exploit Locator.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Exploit Locator.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Exploit Locator.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Exploit Locator.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Exploit Locator.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Exploit Locator.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: jsc.exe, 00000006.00000002.108654558266.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enA0
Source: Microsoft.VisualStudio.ScriptedHost.dll.5.dr, is-TVGL8.tmp.4.dr	String found in binary or memory: http://daytona/plugin.js:http://scriptedhost/plugin.js
Source: Microsoft.VisualStudio.ScriptedHost.dll.5.dr, is-TVGL8.tmp.4.dr	String found in binary or memory: http://daytona/plugin.js;http://scriptedhost/plugin.jsAhttp://scriptedhost.vs/plugin.js
Source: Exploit Locator.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Exploit Locator.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: is-1O67P.tmp.4.dr, libomp140.x86_64.dll.5.dr	String found in binary or memory: http://openmp.llvm.org/
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Microsoft.VisualStudio.ScriptedHost.dll.5.dr, is-TVGL8.tmp.4.dr	String found in binary or memory: http://scriptedhost.vs/plugin.jsZ--enable-features=msIntelLockFileExWorkaround
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: AutoIt3.exe, 00000005.00000000.107674535378.00000000006B5000.00000002.00000001.01000000.0000000F.sdmp, AutoIt3.exe, 00000007.00000000.107777138251.0000000000655000.00000002.00000001.01000000.00000012.sdmp, AutoIt3.exe, 00000009.00000000.107858100580.0000000000655000.00000002.00000001.01000000.00000012.sdmp, is-5A5NI.tmp.4.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Exploit Locator.exe, Exploit Locator.tmp.0.dr, Exploit Locator.tmp.3.dr	String found in binary or memory: http://www.innosetup.com/
Source: Exploit Locator.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: Exploit Locator.exe, Exploit Locator.tmp.0.dr, Exploit Locator.tmp.3.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: is-V93MM.tmp.4.dr	String found in binary or memory: http://www.vmware.com/0
Source: is-1O67P.tmp.4.dr, libomp140.x86_64.dll.5.dr	String found in binary or memory: https://bugs.llvm.org/.
Source: Microsoft.VisualStudio.ScriptedHost.dll.5.dr, is-TVGL8.tmp.4.dr	String found in binary or memory: https://devdiv.visualstudio.com/DevDiv/_git/VS?path=/src/env/shell/UIInternal/MainWindow/Controls/Vs
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: is-27FQL.tmp.4.dr	String found in binary or memory: https://github.com/dotnet/aspnetcore
Source: is-27FQL.tmp.4.dr	String found in binary or memory: https://github.com/dotnet/aspnetcore/tree/57512b49997283599b00a6b67d0ccebaec171daf
Source: is-9J9G5.tmp.4.dr	String found in binary or memory: https://github.com/dotnet/roslyn
Source: is-CLFPL.tmp.4.dr, System.CodeDom.dll.5.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://github.com/heimdal/heimdal/issues
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://github.com/heimdal/heimdal/issuesSend
Source: is-2MCT9.tmp.4.dr	String found in binary or memory: https://github.com/libgit2/libgit2sharp
Source: is-2MCT9.tmp.4.dr	String found in binary or memory: https://github.com/libgit2/libgit2sharp:
Source: is-VCSQ6.tmp.4.dr	String found in binary or memory: https://icann.org/namecollision
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://icann.org/namecollision%dsearching
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://icann.org/namecollisionRealm
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://icann.org/namecollisiondns_lookup_realmdomain_realmdns_locateunable
Source: msys-krb5-26.dll.5.dr, is-VCSQ6.tmp.4.dr	String found in binary or memory: https://icann.org/namecollisionrealmsconfiguration
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Exploit Locator.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: is-5A5NI.tmp.4.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03112201	6_2_03112201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_031140D8	6_2_031140D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03114438	6_2_03114438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03110FB0	6_2_03110FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03110CD0	6_2_03110CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_031122B1	6_2_031122B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03111061	6_2_03111061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03112538	6_2_03112538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0311442B	6_2_0311442B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_031114EC	6_2_031114EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_031119C1	6_2_031119C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_031118C2	6_2_031118C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03110FA2	6_2_03110FA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03110FEA	6_2_03110FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03119C53	6_2_03119C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_03119C88	6_2_03119C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A8A588	6_2_05A8A588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A88648	6_2_05A88648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A833D8	6_2_05A833D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A8BA70	6_2_05A8BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A85680	6_2_05A85680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A8DEB8	6_2_05A8DEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A838BC	6_2_05A838BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A93730	6_2_05A93730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A9F6C0	6_2_05A9F6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A94900	6_2_05A94900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B5BF70	6_2_05B5BF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B5BF60	6_2_05B5BF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B5832F	6_2_05B5832F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B58340	6_2_05B58340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B5DA28	6_2_05B5DA28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B5DA01	6_2_05B5DA01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05B56A48	6_2_05B56A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA7D20	6_2_05BA7D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA8938	6_2_05BA8938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAB8A0	6_2_05BAB8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA8068	6_2_05BA8068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BADBB4	6_2_05BADBB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BADC89	6_2_05BADC89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAD75B	6_2_05BAD75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAD66F	6_2_05BAD66F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAD666	6_2_05BAD666
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA2188	6_2_05BA2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAB1D2	6_2_05BAB1D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BAB890	6_2_05BAB890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA0032	6_2_05BA0032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA0040	6_2_05BA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BADBBD	6_2_05BADBBD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CA428	6_2_065CA428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065C9545	6_2_065C9545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CA421	6_2_065CA421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CA198	6_2_065CA198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CA18A	6_2_065CA18A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07562C11	6_2_07562C11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07562C20	6_2_07562C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07577C40	6_2_07577C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07577BCA	6_2_07577BCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07577BEE	6_2_07577BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07577DD7	6_2_07577DD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0758E2AC	6_2_0758E2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0758CF96	6_2_0758CF96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0758CED7	6_2_0758CED7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0758CEEA	6_2_0758CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07880AA0	6_2_07880AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E2201	8_2_032E2201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E40D8	8_2_032E40D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E4438	8_2_032E4438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E0FB0	8_2_032E0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E0CD0	8_2_032E0CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E22B1	8_2_032E22B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E1061	8_2_032E1061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E2538	8_2_032E2538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E14EC	8_2_032E14EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E19C1	8_2_032E19C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E18C2	8_2_032E18C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E0FA3	8_2_032E0FA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E0FEA	8_2_032E0FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E9C88	8_2_032E9C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_032E9C85	8_2_032E9C85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BDA588	8_2_05BDA588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BD8648	8_2_05BD8648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BD33D8	8_2_05BD33D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BDBA70	8_2_05BDBA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BD5680	8_2_05BD5680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BDDEB8	8_2_05BDDEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BD38BC	8_2_05BD38BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BE3730	8_2_05BE3730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BEF6C0	8_2_05BEF6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05BE4900	8_2_05BE4900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CABF42	8_2_05CABF42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CABF70	8_2_05CABF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CA8340	8_2_05CA8340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CA832F	8_2_05CA832F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CA6A48	8_2_05CA6A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CADA28	8_2_05CADA28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CADA27	8_2_05CADA27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CF2188	8_2_05CF2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CF0040	8_2_05CF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CF0023	8_2_05CF0023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03012201	10_2_03012201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_030140D8	10_2_030140D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03014438	10_2_03014438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03010FB0	10_2_03010FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03010CD0	10_2_03010CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_030122B1	10_2_030122B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03011061	10_2_03011061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03012538	10_2_03012538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0301442B	10_2_0301442B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_030114EC	10_2_030114EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_030119C1	10_2_030119C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_030118C2	10_2_030118C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03010FA3	10_2_03010FA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03010FEA	10_2_03010FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03019C6F	10_2_03019C6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_03019C88	10_2_03019C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058AA588	10_2_058AA588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058A8648	10_2_058A8648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058A33D8	10_2_058A33D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058ABA70	10_2_058ABA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058A5680	10_2_058A5680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058ADEB8	10_2_058ADEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058A38BC	10_2_058A38BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058B3730	10_2_058B3730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058BF6C0	10_2_058BF6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058B4900	10_2_058B4900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0597BF70	10_2_0597BF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0597BF60	10_2_0597BF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0597832F	10_2_0597832F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_05978340	10_2_05978340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0597DA01	10_2_0597DA01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0597DA28	10_2_0597DA28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_05976A48	10_2_05976A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_059C2188	10_2_059C2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_059C0006	10_2_059C0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_059C0040	10_2_059C0040

Source: Joe Sandbox View

Dropped File: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe 1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48

Source: Exploit Locator.exe

Static PE information: invalid certificate

Source: Exploit Locator.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Exploit Locator.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Exploit Locator.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Exploit Locator.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-1O67P.tmp.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: is-1SI20.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: is-FQK34.tmp.4.dr	Static PE information: Number of sections : 11 > 10

Source: is-27FQL.tmp.4.dr	Static PE information: No import functions for PE file found
Source: is-CLFPL.tmp.4.dr	Static PE information: No import functions for PE file found

Source: Exploit Locator.exe, 00000000.00000003.107380147596.000000007FE42000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Exploit Locator.exe
Source: Exploit Locator.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Exploit Locator.exe

Source: Exploit Locator.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@17/77@0/1

Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: \Sessions\1\BaseNamedObjects\87a1fee0ad30

Source: C:\Users\user\Desktop\Exploit Locator.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: Exploit Locator.exe	String found in binary or memory: /LOADINF="filename"
Source: Exploit Locator.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: Exploit Locator.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: Exploit Locator.exe	String found in binary or memory: /LoadInf=
Source: Exploit Locator.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: unknown	Process created: C:\Users\user\Desktop\Exploit Locator.exe "C:\Users\user\Desktop\Exploit Locator.exe"
Source: C:\Users\user\Desktop\Exploit Locator.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp "C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp" /SL5="$10452,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process created: C:\Users\user\Desktop\Exploit Locator.exe "C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT
Source: C:\Users\user\Desktop\Exploit Locator.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp "C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp" /SL5="$3047E,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe "C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe" matriculates.a3x
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: unknown	Process created: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\matriculates.a3x"
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: unknown	Process created: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\matriculates.a3x"
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\Exploit Locator.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp "C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp" /SL5="$10452,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process created: C:\Users\user\Desktop\Exploit Locator.exe "C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp "C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp" /SL5="$3047E,9589775,118784,C:\Users\user\Desktop\Exploit Locator.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe "C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe" matriculates.a3x	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior

Source: is-1O67P.tmp.4.dr	Static PE information: section name: _RDATA
Source: is-ADD8T.tmp.4.dr	Static PE information: section name: .sdbid
Source: is-VCSQ6.tmp.4.dr	Static PE information: section name: .buildid
Source: is-VCSQ6.tmp.4.dr	Static PE information: section name: .xdata
Source: is-4Q16D.tmp.4.dr	Static PE information: section name: .buildid
Source: is-4Q16D.tmp.4.dr	Static PE information: section name: .xdata
Source: is-FQK34.tmp.4.dr	Static PE information: section name: .xdata
Source: is-1SI20.tmp.4.dr	Static PE information: section name: .xdata
Source: is-SKH9A.tmp.4.dr	Static PE information: section name: .symtab

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05A98E7B push eax; retf	6_2_05A98E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA1ED2 push esp; retn 05B6h	6_2_05BA202D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_05BA1148 push eax; iretd	6_2_05BA1149
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CC42D push cs; retf	6_2_065CC42E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CF870 push es; iretd	6_2_065CF878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_065CF89A push es; ret	6_2_065CF8A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07526041 push 8B043B3Ah; iretd	6_2_07526046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07560157 push esp; retf	6_2_07560169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07567F22 pushfd ; ret	6_2_07567F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07567EC2 push esp; ret	6_2_07567EC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_0757CE26 push esi; iretd	6_2_0757CE27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 6_2_07588BFB push ecx; iretd	6_2_07588BFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CA2451 push es; retf	8_2_05CA245E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_05CF1148 push eax; iretd	8_2_05CF1149
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_058B8E7B push eax; retf	10_2_058B8E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_059C1148 push eax; iretd	10_2_059C1149

Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\msys-krb5-26.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-ADD8T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\msys-krb5-26.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\mit2ms.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-2MCT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\msadomd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\System.CodeDom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\System.CodeDom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\SSLeay.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-27FQL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-7A12Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\edit_test_dll.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\tclsh.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\bzcat.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-G6IEM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\mshwLatin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-SKH9A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-6TS96.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\libomp140.x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\hostpolicy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\git-credential-manager-core.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\git-lfs.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\odt2txt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\LibGit2Sharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.VisualStudio.LanguageServices.Implementation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-4Q16D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-1O67P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\WinPixSysMonController.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-5A5NI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-FRBPQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-V93MM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-9J9G5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.VisualStudio.ScriptedHost.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-CLFPL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\msadomd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.AspNetCore.Mvc.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.TeamFoundation.WorkItemTracking.Controls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Exploit Locator.exe	File created: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-BHPBG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-3554K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\mshwLatin.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Exploit Locator.exe	File created: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-090ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-VCSQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\SSLeay.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\WinPixSysMonController.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\tclsh86.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-TVGL8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.VisualStudio.ScriptedHost.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\LibGit2Sharp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-K22DN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-FQK34.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\libomp140.x86_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-1SI20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\pkcs1-conv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\hostpolicy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.TeamFoundation.WorkItemTracking.Controls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-BPUG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	File created: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.AspNetCore.Mvc.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	File created: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.VisualStudio.LanguageServices.Implementation.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce matriculates	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce matriculates	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce matriculates	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce matriculates	Jump to behavior

Source: C:\Users\user\Desktop\Exploit Locator.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Exploit Locator.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 5440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\msys-krb5-26.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-ADD8T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\msys-krb5-26.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\mit2ms.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-2MCT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\System.CodeDom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\msadomd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\System.CodeDom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\SSLeay.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-27FQL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\edit_test_dll.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-7A12Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\tclsh.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\bzcat.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\mshwLatin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-G6IEM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-SKH9A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-6TS96.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\libomp140.x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\hostpolicy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\git-lfs.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\git-credential-manager-core.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\odt2txt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\LibGit2Sharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.VisualStudio.LanguageServices.Implementation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-4Q16D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-1O67P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\WinPixSysMonController.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-V93MM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-FRBPQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.VisualStudio.ScriptedHost.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-9J9G5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-CLFPL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\msadomd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.AspNetCore.Mvc.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.TeamFoundation.WorkItemTracking.Controls.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-BHPBG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-3554K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\mshwLatin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-090ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-VCSQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-M2OLV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\SSLeay.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\WinPixSysMonController.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\tclsh86.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-TVGL8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.VisualStudio.ScriptedHost.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\LibGit2Sharp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-K22DN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\libomp140.x86_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-FQK34.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\is-1SI20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\bin\pkcs1-conv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\hostpolicy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.TeamFoundation.WorkItemTracking.Controls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\is-BPUG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ON0H6.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Dropped PE file which has not been started: C:\11389406-0377-47ed-98c7-d564e683c6eb\Microsoft.AspNetCore.Mvc.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\Microsoft.VisualStudio.LanguageServices.Implementation.dll (copy)	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8760	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OEOV4.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CCLDA.tmp\Exploit Locator.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior

Source: is-V93MM.tmp.4.dr	Binary or memory string: VMware, Inc.1>0<
Source: is-V93MM.tmp.4.dr	Binary or memory string: http://www.vmware.com/0
Source: is-V93MM.tmp.4.dr	Binary or memory string: VMware, Inc.0
Source: Exploit Locator.exe	Binary or memory string: QEMu&
Source: jsc.exe, 00000006.00000002.108639279772.0000000001409000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll''

Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 11C0000 protect: page execute and read and write	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 1310000 protect: page execute and read and write	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 1000000 protect: page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\{9B078D9F-6EFE-4932-91A5-2DC4F240B955}\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 11C0000 value starts with: 4D5A	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 1310000 value starts with: 4D5A	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 1000000 value starts with: 4D5A	Jump to behavior

Source: AutoIt3.exe, 00000005.00000000.107674253229.00000000006A1000.00000002.00000001.01000000.0000000F.sdmp, AutoIt3.exe, 00000007.00000000.107776946627.0000000000641000.00000002.00000001.01000000.00000012.sdmp, AutoIt3.exe, 00000009.00000000.107857752876.0000000000641000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: jsc.exe, 00000006.00000002.108642337142.0000000003817000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000006.00000002.108642337142.0000000003841000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000006.00000002.108642337142.00000000037A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: jsc.exe, 00000006.00000002.108642337142.0000000003817000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000006.00000002.108642337142.0000000003841000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000006.00000002.108642337142.00000000037A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: jsc.exe, 00000006.00000002.108642337142.0000000003817000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000006.00000002.108642337142.0000000003841000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Exploit Locator.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Exploit Locator.exe

Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: jsc.exe, 00000006.00000002.108647879079.00000000045E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HJaxXiytlJ
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3
Source: jsc.exe, 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: jsc.exe, 00000006.00000002.108647879079.00000000045E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Source: Yara match	File source: 00000008.00000002.107999346431.0000000003472000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.108642337142.0000000003379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8724, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	312 Process Injection	1 Masquerading	OS Credential Dumping	441 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	341 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	312 Process Injection	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement