Edit tour

Windows Analysis Report
Setup64.exe

Overview

General Information

Sample name:	Setup64.exe
Analysis ID:	1633383
MD5:	4d091a9b11bbe7d8c68951b9780a92ea
SHA1:	c0684053ee4b6d22d469bdb51436bfc45cf31e3b
SHA256:	5a720bf1f2099c701a7bffba78c0c50288984e10b24b32c110e570c787674a50
Infos:

Detection

PureCrypter, AsyncRAT

Score:	52
Range:	0 - 100
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Allocates memory in foreign processes

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

Setup64.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\Setup64.exe" MD5: 4D091A9B11BBE7D8C68951B9780A92EA)

Setup64.tmp (PID: 1164 cmdline: "C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp" /SL5="$2046A,8170310,119296,C:\Users\user\Desktop\Setup64.exe" MD5: B1F9D665E52C29972B50D7145D88DCE1)

Setup64.exe (PID: 5588 cmdline: "C:\Users\user\Desktop\Setup64.exe" /VERYSILENT MD5: 4D091A9B11BBE7D8C68951B9780A92EA)

Setup64.tmp (PID: 7244 cmdline: "C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp" /SL5="$2046E,8170310,119296,C:\Users\user\Desktop\Setup64.exe" /VERYSILENT MD5: B1F9D665E52C29972B50D7145D88DCE1)

AutoIt3.exe (PID: 8444 cmdline: "C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe" randomized.a3x MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

AutoIt3.exe (PID: 8560 cmdline: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.a3x" MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8716 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

AutoIt3.exe (PID: 8760 cmdline: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.a3x" MD5: 3F58A517F1F4796225137E7659AD2ADB)

jsc.exe (PID: 8832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT_1	Yara detected AsyncRAT	Joe Security
0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT_1	Yara detected AsyncRAT	Joe Security
00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 8508	JoeSecurity_AsyncRAT_1	Yara detected AsyncRAT	Joe Security
Process Memory Space: jsc.exe PID: 8508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jsc.exe PID: 8716	JoeSecurity_AsyncRAT_1	Yara detected AsyncRAT	Joe Security
Process Memory Space: jsc.exe PID: 8716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.a3x", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe, ProcessId: 8444, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\randomized

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe, ProcessId: 8444, TargetFilename: C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.pptm

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T09:49:21.881535+0100	2028371	3	Unknown Traffic	192.168.11.30	50278	23.209.72.8	443	TCP
2025-03-10T09:50:25.312978+0100	2028371	3	Unknown Traffic	192.168.11.30	50282	23.209.72.8	443	TCP

ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T09:49:52.396932+0100	2035595	1	Domain Observed Used for C2 Detected	151.80.89.228	56001	192.168.11.30	50280	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup64.exe	Virustotal: Detection: 12%			Perma Link
Source: Setup64.exe	ReversingLabs: Detection: 15%

Compliance

Uses 32bit PE files

Source: Setup64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

PE / OLE file has a valid certificate

Source: Setup64.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Setup64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\cpfecl.Linux.x86.pdb source: cpfecl.Linux.x86.dll.7.dr
Source:	Binary string: D:\dbs\sh\ddvsm\1002_165500_0\cmd\1g\out\Intermediate\env\viewmanager_x86retail_ED4D250F\Release\net472\Microsoft.VisualStudio.Shell.ViewManager.pdb source: is-23SSU.tmp.4.dr, Microsoft.VisualStudio.Shell.ViewManager.dll.7.dr
Source:	Binary string: D:\dbs\sh\ddvsm\1001_131954\cmd\1c\out\binaries\amd64ret\bin\amd64\Microsoft.VisualStudio.ResPkg.Internal.pdb source: Microsoft.VisualStudio.ResPkg.Internal.dll.7.dr, is-JMHCG.tmp.4.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/netstandard2.0/Newtonsoft.Json.pdbSHA256 source: Newtonsoft.Json.dll.7.dr
Source:	Binary string: Unknown exceptionbad array new lengthstring too longNULLPATH exsyglindbmdlk\DFoFebAbabDbDEbcbCrtbdbEbFdbhBibilbmbobxbpbrbtbUbubvBCBkBreproexperimental:deterministicBtBt+BdBUIastfe:Baanalyze:Bnanalyze:logBzBvBYFmFCforceZ7GLbLTCGDBLDLDdopenmpXFdGmFRFrkernelarchSSEarchSSE2archAVXarchAVX2d2MPXZiZ7ZIZXGiZmZMclrclr-clrnoassemblyLNclr:netcoreZWMPMPlowpriSaw_ESaw_EPSaw_GmSaw_showIncludesSaw_YcSaw_AnalyzeLogMsyncerrMdebugMbatchdocsrclisterrorreport:prompterrorreport:queueerrorreport:senderrorreport:noneawaitawait:heapelideexternal:env:Bcapture_repro-il%t-typedil-f%f-W1-Zp8-Gs-Ot-Ob0-Fe%b.%X-pc\:/-Fdvc140.pdb-ZM-GS-GR-Zc:forScope-Zc:wchar_t-Xc-ClangMode-ClangXp-Clangstdc17-ClangPredefinedMacros-ClangPredefinedCMacros-ClangPredefinedCppMacros-ClangBuiltinMacros-ClangPredefined32bitMacros-MD-MT-MDd-MTdBk source: cpfecl.Linux.x86.dll.7.dr
Source:	Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\git.pdb source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\cpfecl.Linux.x86.pdbGCTL source: cpfecl.Linux.x86.dll.7.dr
Source:	Binary string: D:\dbs\sh\ddvsm\1001_131954\cmd\1c\out\binaries\amd64ret\bin\amd64\Microsoft.VisualStudio.ResPkg.Internal.pdbBSJB source: Microsoft.VisualStudio.ResPkg.Internal.dll.7.dr, is-JMHCG.tmp.4.dr
Source:	Binary string: System.Workflow.Activities.pdbL source: is-B4U7K.tmp.4.dr
Source:	Binary string: G:\o14\65_VC8\VBA\R7X64ND\presplit\vbarunjt\obj\expsrv.pdb source: is-NGK02.tmp.4.dr
Source:	Binary string: System.Workflow.Activities.pdb source: is-B4U7K.tmp.4.dr
Source:	Binary string: D:\a\git-credential-manager\git-credential-manager\out\windows\Git-Credential-Manager.UI.Windows\obj\WindowsRelease\net472\git-credential-manager-ui.pdbSHA256 source: is-ANH49.tmp.4.dr
Source:	Binary string: D:\a\git-credential-manager\git-credential-manager\out\windows\Git-Credential-Manager.UI.Windows\obj\WindowsRelease\net472\git-credential-manager-ui.pdb source: is-ANH49.tmp.4.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/netstandard2.0/Newtonsoft.Json.pdb source: Newtonsoft.Json.dll.7.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdb source: Microsoft.Diagnostics.NETCore.Client.dll.7.dr
Source:	Binary string: C:\JDK7U2~1\jdk7u17\build\windows-amd64\tmp\deploy\plugin\npdeployJava1\obj\npdeployJava1.pdb source: npdeployJava1.dll.7.dr
Source:	Binary string: F:\SMGB 5\OverClock\OverClock\Release\OverDrive.pdb source: is-1ON8V.tmp.4.dr
Source:	Binary string: Microsoft.Diagnostics.NETCore.Client.ni.pdb source: Microsoft.Diagnostics.NETCore.Client.dll.7.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert : 151.80.89.228:56001 -> 192.168.11.30:50280

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.11.30:50280 -> 151.80.89.228:56001

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:50282 -> 23.209.72.8:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:50278 -> 23.209.72.8:443

Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228
Source: unknown	TCP traffic detected without corresponding DNS query: 151.80.89.228

Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: Setup64.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: Setup64.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124990406376.0000000005100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: jsc.exe, 00000008.00000002.2124978680788.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: is-0G37M.tmp.4.dr, npdeployJava1.dll.7.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Setup64.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Setup64.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Setup64.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Setup64.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: jsc.exe, 00000008.00000002.2124978680788.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: jsc.exe, 00000008.00000002.2124978680788.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: npdeployJava1.dll.7.dr	String found in binary or memory: http://download.oracle.com/otn-pub/java/javafx/javafx-windows-x64__Vlatest.exehttp://getjfx.us.oracl
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://epscd.catcert.net/crl/ec-acc.crl0.
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://epscd2.catcert.net/crl/ec-acc.crl0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: npdeployJava1.dll.7.dr	String found in binary or memory: http://javadl.oracle.com/webapps/download/AutoDL%s?BundleId=%s%s%stmp%s.0http://javadl.oracle.com/we
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://ocsp.catcert.cat0
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-0G37M.tmp.4.dr, npdeployJava1.dll.7.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Setup64.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: Setup64.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: Setup64.exe	String found in binary or memory: http://ocsps.ssl.com0P
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: is-0G37M.tmp.4.dr, npdeployJava1.dll.7.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-0G37M.tmp.4.dr, npdeployJava1.dll.7.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-0G37M.tmp.4.dr, npdeployJava1.dll.7.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Setup64.tmp, 00000004.00000003.2123903838470.0000000006000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AutoIt3.exe, 00000007.00000000.2123903468842.00000000007F5000.00000002.00000001.01000000.0000000C.sdmp, AutoIt3.exe, 00000009.00000000.2124047458296.00000000007E5000.00000002.00000001.01000000.0000000F.sdmp, AutoIt3.exe, 0000000B.00000000.2124128443433.00000000007E5000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://www.catcert.cat/descarrega/acc.crt0#
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Setup64.exe, Setup64.tmp.1.dr, Setup64.tmp.3.dr	String found in binary or memory: http://www.innosetup.com/
Source: Setup64.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Setup64.exe, Setup64.tmp.1.dr, Setup64.tmp.3.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: Setup64.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Setup64.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: is-0G37M.tmp.4.dr	String found in binary or memory: http://www.vmware.com/0
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: Microsoft.Diagnostics.NETCore.Client.dll.7.dr	String found in binary or memory: https://github.com/dotnet/diagnostics
Source: Setup64.tmp, 00000004.00000003.2123903838470.0000000006000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/git-for-windows/git/issues/new
Source: Setup64.tmp, 00000004.00000003.2123903838470.000000000636C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: is-7TIQP.tmp.4.dr, is-LTCSU.tmp.4.dr	String found in binary or memory: https://tukaani.org/
Source: is-LTCSU.tmp.4.dr	String found in binary or memory: https://tukaani.org/xz/
Source: is-7TIQP.tmp.4.dr	String found in binary or memory: https://tukaani.org/xz/XZ
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: https://www.catcert.cat/verCIT-10
Source: is-1ON8V.tmp.4.dr	String found in binary or memory: https://www.catcert.net/verarrel
Source: Newtonsoft.Json.dll.7.dr, is-1ON8V.tmp.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Newtonsoft.Json.dll.7.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: Setup64.exe	String found in binary or memory: https://www.ssl.com/repository0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0000000A.00000002.2124288840735.00000000029E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2124981884980.0000000002854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 8716, type: MEMORYSTR

System Summary

Detected potential crypto function

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E2240	8_2_026E2240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E4118	8_2_026E4118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E4478	8_2_026E4478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E2578	8_2_026E2578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E0FA8	8_2_026E0FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E0CD0	8_2_026E0CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E22F1	8_2_026E22F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E1059	8_2_026E1059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E40EF	8_2_026E40EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E4468	8_2_026E4468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E1512	8_2_026E1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E9B38	8_2_026E9B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E9B37	8_2_026E9B37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E18FE	8_2_026E18FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E19FE	8_2_026E19FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E0FE2	8_2_026E0FE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_026E0F99	8_2_026E0F99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FDA5A8	8_2_04FDA5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FD8668	8_2_04FD8668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FD33F8	8_2_04FD33F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FD56A0	8_2_04FD56A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FDDEC0	8_2_04FDDEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FD38E5	8_2_04FD38E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FF35B0	8_2_04FF35B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FFF510	8_2_04FFF510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FF4781	8_2_04FF4781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050ABEE0	8_2_050ABEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050ABEF0	8_2_050ABEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050AD997	8_2_050AD997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050AD9A8	8_2_050AD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050A69C8	8_2_050A69C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050A82AF	8_2_050A82AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050A82C0	8_2_050A82C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F7D18	8_2_050F7D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F8930	8_2_050F8930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F8060	8_2_050F8060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FB8A0	8_2_050FB8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FDB82	8_2_050FDB82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FDC5A	8_2_050FDC5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FD72E	8_2_050FD72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FD647	8_2_050FD647
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FD650	8_2_050FD650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F2188	8_2_050F2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FB1D5	8_2_050FB1D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F001F	8_2_050F001F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F0040	8_2_050F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FB890	8_2_050FB890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050FDB8B	8_2_050FDB8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F84118	10_2_00F84118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F82240	10_2_00F82240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F84478	10_2_00F84478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F82578	10_2_00F82578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F80CD0	10_2_00F80CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F80FA8	10_2_00F80FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F81059	10_2_00F81059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F822F1	10_2_00F822F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F84468	10_2_00F84468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F81512	10_2_00F81512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F818FE	10_2_00F818FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F819FE	10_2_00F819FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F89986	10_2_00F89986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F89B38	10_2_00F89B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F80FE2	10_2_00F80FE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_00F80F99	10_2_00F80F99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_050BF510	10_2_050BF510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_050B35B0	10_2_050B35B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_050B4781	10_2_050B4781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0516BEF0	10_2_0516BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0516BEE0	10_2_0516BEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0516D997	10_2_0516D997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0516D9A8	10_2_0516D9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051669C8	10_2_051669C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051682AF	10_2_051682AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051682C0	10_2_051682C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051B2188	10_2_051B2188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051B0006	10_2_051B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051B0040	10_2_051B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF4118	12_2_00DF4118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF2240	12_2_00DF2240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF4478	12_2_00DF4478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF2578	12_2_00DF2578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF0CD0	12_2_00DF0CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF0FA8	12_2_00DF0FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF1059	12_2_00DF1059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF22F1	12_2_00DF22F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF4468	12_2_00DF4468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF441B	12_2_00DF441B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF1512	12_2_00DF1512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF18FE	12_2_00DF18FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF19FE	12_2_00DF19FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF9A67	12_2_00DF9A67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF9B38	12_2_00DF9B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF0FE2	12_2_00DF0FE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_00DF0F9B	12_2_00DF0F9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F0A5A8	12_2_04F0A5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F08668	12_2_04F08668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F033F8	12_2_04F033F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F056A0	12_2_04F056A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F0DEC0	12_2_04F0DEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F038E5	12_2_04F038E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F235B0	12_2_04F235B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F2F510	12_2_04F2F510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F24781	12_2_04F24781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FDBEF0	12_2_04FDBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FDBEE0	12_2_04FDBEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FD69C8	12_2_04FD69C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FDD9A8	12_2_04FDD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FDD980	12_2_04FDD980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FD82C0	12_2_04FD82C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04FD82AF	12_2_04FD82AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_05022188	12_2_05022188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_05020006	12_2_05020006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_05020040	12_2_05020040

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe 1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48

PE file contains executable resources (Code or Archives)

Source: Setup64.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup64.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Setup64.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup64.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

PE file contains more sections than normal

Source: is-LTCSU.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: is-U03MI.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: is-OI8JK.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: is-L5JQU.tmp.4.dr	Static PE information: Number of sections : 12 > 10
Source: is-432HO.tmp.4.dr	Static PE information: Number of sections : 13 > 10
Source: is-I86N2.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: is-7TIQP.tmp.4.dr	Static PE information: Number of sections : 11 > 10

PE file does not import any functions

Source: is-R20PO.tmp.4.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: Setup64.exe, 00000001.00000003.2123732684001.000000007FE42000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup64.exe
Source: Setup64.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Setup64.exe

Uses 32bit PE files

Source: Setup64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-OI8JK.tmp.4.dr	Binary string: \Device\LanmanRedirector\
Source: is-OI8JK.tmp.4.dr	Binary string: \Device\H
Source: is-OI8JK.tmp.4.dr	Binary string: \Device\LanmanRedirector\;%c:%d\%s
Source: is-OI8JK.tmp.4.dr	Binary string: \Device\LanmanRedirector\\Device\LanmanRedirector\;%c:%d\%sbasic_string::append\??\ntdll.dllNtQuerySystemInformationNtQueryObjectNtQueryInformationThreadNtQueryInformationFileNtQueryInformationProcessNtQuerySystemInformation: 0x%lx

Source: is-5H3HC.tmp.4.dr

Binary or memory string: Find ResultsAA publish must be performed before this information is available.?Please select one of the collections of settings from the list.xThe codepage indicated by the HTML charset tag may not be correct. You may want to reopen this with a specific encoding."XML comment contains invalid XML: ?Solution Files (*%s)$*%s$Solution Filter Files (*.slnf)$*.slnf$;The document '%s' is already open. Do you want to close it?

Source: classification engine

Classification label: mal52.troj.spyw.evad.winEXE@17/126@0/1

Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: \Sessions\1\BaseNamedObjects\84f4929d999d

Source: C:\Users\user\Desktop\Setup64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: Setup64.exe	String found in binary or memory: /LOADINF="filename"
Source: Setup64.exe	String found in binary or memory: {userappdata}\{{A46AD241-79D3-4860-A319-5E4C9914D262}\Sup\git-credential-helper-selector.exe
Source: Setup64.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: Setup64.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: Setup64.exe	String found in binary or memory: /LoadInf=
Source: Setup64.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: unknown	Process created: C:\Users\user\Desktop\Setup64.exe "C:\Users\user\Desktop\Setup64.exe"
Source: C:\Users\user\Desktop\Setup64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp "C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp" /SL5="$2046A,8170310,119296,C:\Users\user\Desktop\Setup64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process created: C:\Users\user\Desktop\Setup64.exe "C:\Users\user\Desktop\Setup64.exe" /VERYSILENT
Source: C:\Users\user\Desktop\Setup64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp "C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp" /SL5="$2046E,8170310,119296,C:\Users\user\Desktop\Setup64.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process created: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe "C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe" randomized.a3x
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: unknown	Process created: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.a3x"
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: unknown	Process created: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe "C:\11389406-0377-47ed-98c7-d564e683c6eb\Autoit3.exe" "C:\11389406-0377-47ed-98c7-d564e683c6eb\randomized.a3x"
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: C:\Users\user\Desktop\Setup64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp "C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp" /SL5="$2046A,8170310,119296,C:\Users\user\Desktop\Setup64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process created: C:\Users\user\Desktop\Setup64.exe "C:\Users\user\Desktop\Setup64.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp "C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp" /SL5="$2046E,8170310,119296,C:\Users\user\Desktop\Setup64.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process created: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe "C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe" randomized.a3x	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior

Source: is-432HO.tmp.4.dr	Static PE information: section name: .xdata
Source: is-432HO.tmp.4.dr	Static PE information: section name: .debug
Source: is-LTCSU.tmp.4.dr	Static PE information: section name: .xdata
Source: is-U03MI.tmp.4.dr	Static PE information: section name: .xdata
Source: is-I86N2.tmp.4.dr	Static PE information: section name: .xdata
Source: is-7TIQP.tmp.4.dr	Static PE information: section name: .xdata
Source: is-OI8JK.tmp.4.dr	Static PE information: section name: .xdata
Source: is-4ORF2.tmp.4.dr	Static PE information: section name: .xdata
Source: is-NGK02.tmp.4.dr	Static PE information: section name: ENGINE
Source: is-L5JQU.tmp.4.dr	Static PE information: section name: .rodata
Source: is-L5JQU.tmp.4.dr	Static PE information: section name: .xdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FA12E8 push esp; retf	8_2_04FA1305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FD79A8 push eax; ret	8_2_04FD79A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FDBB89 push 8B03880Ch; iretd	8_2_04FDBB8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_04FF8D38 pushad ; retf	8_2_04FF8D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 8_2_050F119B push esp; iretd	8_2_050F11A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_029912EA push esp; retf	10_2_02991305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_0299137E pushfd ; retf	10_2_02991395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_050B8D38 pushad ; retf	10_2_050B8D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 10_2_051B1150 push esp; iretd	10_2_051B11A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04ED12E9 push esp; retf	12_2_04ED1305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F079A8 push eax; ret	12_2_04F079A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F0BB89 push 8B03800Ch; iretd	12_2_04F0BB8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_04F28D38 pushad ; retf	12_2_04F28D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 12_2_05022DE7 push ebx; ret	12_2_05022DEA

Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce randomized	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce randomized	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce randomized	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce randomized	Jump to behavior

Source: C:\Users\user\Desktop\Setup64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 27B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8612	Thread sleep count: 9963 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -34891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -34781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -34672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8596	Thread sleep time: -34563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 8856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-N6RL8.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JJO02.tmp\Setup64.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior

Source: is-0G37M.tmp.4.dr	Binary or memory string: VMware, Inc.1>0<
Source: AutoIt3.exe, 0000000B.00000003.2124132169902.0000000003AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @UVMCIG3 tbheeszjsh
Source: is-0G37M.tmp.4.dr	Binary or memory string: http://www.vmware.com/0
Source: is-0G37M.tmp.4.dr	Binary or memory string: VMware, Inc.0
Source: AutoIt3.exe, 00000007.00000003.2124019967380.0000000004191000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZPUZXPXK_ZPJZXZOJ_OHTVMCIIQ]
Source: jsc.exe, 00000008.00000002.2124978680788.0000000000808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 710000 protect: page execute and read and write	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 800000 protect: page execute and read and write	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 340000 protect: page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\{A46AD241-79D3-4860-A319-5E4C9914D262}\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 710000 value starts with: 4D5A	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 800000 value starts with: 4D5A	Jump to behavior
Source: C:\11389406-0377-47ed-98c7-d564e683c6eb\AutoIt3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 340000 value starts with: 4D5A	Jump to behavior

Source: AutoIt3.exe, 00000007.00000000.2123903185115.00000000007E1000.00000002.00000001.01000000.0000000C.sdmp, AutoIt3.exe, 00000009.00000000.2124047192710.00000000007D1000.00000002.00000001.01000000.0000000F.sdmp, AutoIt3.exe, 0000000B.00000000.2124128164815.00000000007D1000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124981884980.0000000002BBA000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124981884980.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124992120024.00000000059A0000.00000004.00000020.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124981884980.0000000002BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002BE4000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000008.00000002.2124981884980.0000000002BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior

Source: jsc.exe, 00000008.00000002.2124981884980.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx L4
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q1C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002D1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus4
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: jsc.exe, 00000008.00000002.2124981884980.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Scheduled Task/Job	312 Process Injection	1 Masquerading	OS Credential Dumping	431 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	341 Virtualization/Sandbox Evasion	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 DLL Side-Loading	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup64.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Setup64.exe