Edit tour

Windows Analysis Report
https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe

Overview

General Information

Sample URL:	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe
Analysis ID:	1554902
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Drops PE files

Drops certificate files (DER)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7456 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 7508 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

thonny-4.1.6.exe (PID: 7240 cmdline: "C:\Users\user\Desktop\download\thonny-4.1.6.exe" MD5: E98BBBA2ED9D7CE96F1586A259C8475D)

thonny-4.1.6.tmp (PID: 7224 cmdline: "C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp" /SL5="$2046C,22199615,832512,C:\Users\user\Desktop\download\thonny-4.1.6.exe" MD5: D79DEEDB40FBBA20411722A13B506128)

pythonw.exe (PID: 7892 cmdline: "C:\Users\user\AppData\Local\Programs\Thonny\pythonw.exe" -m compileall . MD5: B6C2CF15F7998BBDD36F3C9D7B5E9EC3)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2596, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, ProcessId: 7456, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2596, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1, ProcessId: 7456, ProcessName: cmd.exe

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T07:38:21.797965+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49732	TCP
2024-11-13T07:38:40.778388+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	53463	TCP
2024-11-13T07:38:43.491076+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	53464	TCP

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\t32.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.0000000006C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\ARM64\Release\w64-arm.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb0DPF source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\w32.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\ARM64\Release\t64-arm.pdb source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.0000000006C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pythonw.pdb source: pythonw.exe, 0000000A.00000000.2701819344.00007FF6B35C2000.00000002.00000001.01000000.00000008.sdmp

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:53464
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:53463

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/163728962/eefec4ff-bfdd-409f-98d7-9262065da9c6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241113%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241113T063752Z&X-Amz-Expires=300&X-Amz-Signature=d5bed8387d507ef1aa658649232a12aedc4c0209003d55207445aafaab850738&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dthonny-4.1.6.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: objects.githubusercontent.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	File created: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\python_tools.cat (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	File created: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-6DKSO.tmp			Jump to dropped file

Source: thonny-4.1.6.tmp.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-6SEJQ.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-G22HU.tmp.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-KBUJC.tmp.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8080
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bit.ly/2h9itJX
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bit.ly/2hrImnY
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.activestate.com/show_bug.cgi?id=85099
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue10272
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue12885)
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue14443
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue15496
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue16298)
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue22384
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue28539
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue7833
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chardet.feedparser.org/
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/578513-get-memory-usage-of-windows-processes-using-getpro/
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/urllib3/issues/detail?id=10
Source: thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cython.org
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dev.w3.org/csswg/css-values/#keywords
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.apple.com/documentation/MacOSX/Conceptual/BPFileSystem/index.html
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/license.html
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.0000000006C00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/reference/datamodel#object.__hash__
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://domain.tld/path/to/resource
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://effbot.org/zone/tkinter-autoscrollbar.htm
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://encoding.spec.whatwg.org/
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://encoding.spec.whatwg.org/#ascii-case-insensitive

Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Section loaded: windows.storage.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Automated click: I accept the agreement

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\thonny-4.1.6.exe "C:\Users\user\Desktop\download\thonny-4.1.6.exe"
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp "C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp" /SL5="$2046C,22199615,832512,C:\Users\user\Desktop\download\thonny-4.1.6.exe"
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process created: C:\Users\user\AppData\Local\Programs\Thonny\pythonw.exe "C:\Users\user\AppData\Local\Programs\Thonny\pythonw.exe" -m compileall .
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp "C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp" /SL5="$2046C,22199615,832512,C:\Users\user\Desktop\download\thonny-4.1.6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process created: C:\Users\user\AppData\Local\Programs\Thonny\pythonw.exe "C:\Users\user\AppData\Local\Programs\Thonny\pythonw.exe" -m compileall .	Jump to behavior

Source: thonny-4.1.6.exe.2.dr	Static PE information: section name: .didata
Source: thonny-4.1.6.tmp.4.dr	Static PE information: section name: .didata
Source: is-6SEJQ.tmp.5.dr	Static PE information: section name: .didata
Source: is-EAPJ0.tmp.5.dr	Static PE information: section name: PyRuntim
Source: is-LCF07.tmp.5.dr	Static PE information: section name: _RDATA
Source: is-V3BUM.tmp.5.dr	Static PE information: section name: .00cfg
Source: is-3FCBM.tmp.5.dr	Static PE information: section name: .00cfg
Source: is-JF1NE.tmp.5.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\download\thonny-4.1.6.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_bz2.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\select.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libcrypto-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BD25O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-ADV2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\tcl86t.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\python.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S1D0H.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\thonny.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\tk86t.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DFRP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\pyexpat.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BMK8B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-49N2O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_elementtree.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\python3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-8DVNS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\Lib\site-packages\is-04TF4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-EAPJ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-QH7BM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-LCF07.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libffi-7.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-LIPVO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-JF1NE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-KBUJC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-5VQML.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-V3BUM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\winsound.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-6HON0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_asyncio.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-56J24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes_test.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-3FCBM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-B4QJT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_decimal.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-R2DEC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DCRMD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\is-1C3P1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\unicodedata.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\tcl\tix8.4.3\is-PGM67.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-KH82K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-LMNJO.tmp	Jump to dropped file

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: thonny-4.1.6.tmp, 00000005.00000003.2937574030.000000000099D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wget.exe, 00000002.00000002.1748442608.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: thonny-4.1.6.tmp, 00000005.00000003.2915368900.0000000006C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	0%	Avira URL Cloud	safe
https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	0%	Virustotal		Browse

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_asyncio.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_bz2.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes_test.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_decimal.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_elementtree.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-3FCBM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-56J24.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-5VQML.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-6HON0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-ADV2T.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-B4QJT.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BD25O.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BMK8B.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DCRMD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DFRP5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-JF1NE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-KBUJC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-KH82K.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-LIPVO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-LMNJO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-R2DEC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-V3BUM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libcrypto-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libffi-7.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\pyexpat.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\select.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\tcl86t.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\tk86t.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\unicodedata.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\winsound.pyd (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\DLLs\zlib1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_aix_support.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_bootsubprocess.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_collections_abc.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_compression.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_markupbase.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_osx_support.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_py_abc.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_pyio.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\_sitebuiltins.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\abc.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\aifc.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\argparse.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\ast.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\asynchat.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\asyncore.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\base64.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\bdb.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\binhex.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\bisect.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\bz2.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\cProfile.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\calendar.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\cgi.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\cgitb.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\chunk.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\cmd.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\code.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\codecs.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\colorsys.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\compileall.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\configparser.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\contextlib.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\contextvars.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\copy.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\copyreg.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\crypt.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\csv.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\dataclasses.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\datetime.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\difflib.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\dis.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\doctest.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\enum.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\filecmp.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\fileinput.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\fnmatch.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\fractions.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\ftplib.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\functools.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\genericpath.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\getopt.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\getpass.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\gettext.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\glob.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\graphlib.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\gzip.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\heapq.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\hmac.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\imaplib.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\imghdr.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\imp.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\inspect.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\io.py (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\is-03QL1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\is-0434H.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Thonny\Lib\is-0K3V5.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://specifications.freedesktop.org/basedir-spec/basedir-spec-	0%	Avira URL Cloud	safe
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	0%	Avira URL Cloud	safe
http://tkinter.unpythonic.net/wiki/VerticalScrolledFrame	0%	Avira URL Cloud	safe
https://bugs.python.org/issue36817)	0%	Avira URL Cloud	safe
http://wiki.tcl.tk/44444	0%	Avira URL Cloud	safe
https://../package_name-0.1.2.tar.gz	0%	Avira URL Cloud	safe
https://w.wiki/Qai	0%	Avira URL Cloud	safe
https://bugs.python.org/issue36054.	0%	Avira URL Cloud	safe
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	0%	Virustotal		Browse
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue33656	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0672/#confusing-features	0%	Avira URL Cloud	safe
http://tkinter.unpythonic.net/wiki/VerticalScrolledFrame	0%	Virustotal		Browse
https://bugs.python.org/issue36817)	0%	Virustotal		Browse
https://pylint.readthedocs.io/en/latest/whatsnew/2/2.14/summary.html#removed-checkers	0%	Avira URL Cloud	safe
https://bugs.python.org/issue13936	0%	Avira URL Cloud	safe
http://bugs.python.org/issue10272	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/deprecated/easy_install.html	0%	Avira URL Cloud	safe
http://wiki.tcl.tk/44444	0%	Virustotal		Browse
http://encoding.spec.whatwg.org/	0%	Avira URL Cloud	safe
http://www.tcl.tk/man/tcl8.6/TkCmd/font.htm#M26	0%	Avira URL Cloud	safe
https://tcl.tk/man/tcl8.6/TkCmd/chooseDirectory.htm	0%	Avira URL Cloud	safe
https://thonny.org0	0%	Avira URL Cloud	safe
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	0%	Avira URL Cloud	safe
http://bugs.python.org/issue22384	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2	0%	Avira URL Cloud	safe
https://bugs.python.org/issue34921	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/578513-get-memory-usage-of-windows-processes-using-getpro/	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/deprecated/easy_install.html#custom-installation-locations	0%	Avira URL Cloud	safe
https://pygments.org/docs/styles/#getting-a-list-of-available-styles).	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/stable/history.html	0%	Avira URL Cloud	safe
http://effbot.org/zone/tkinter-autoscrollbar.htm	0%	Avira URL Cloud	safe
https://six.readthedocs.io/.	0%	Avira URL Cloud	safe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Programs\Thonny\CHANGELOG.rst (copy)

C:\Users\user\AppData\Local\Programs\Thonny\CREDITS.rst (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_asyncio.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_bz2.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_ctypes_test.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_decimal.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\_elementtree.pyd (copy)

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-1POAJ.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-1QHBM.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-3FCBM.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-56J24.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-5VQML.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-6DKSO.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-6HON0.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-7TQFI.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-ADV2T.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-B4QJT.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BD25O.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-BMK8B.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DCRMD.tmp

C:\Users\user\AppData\Local\Programs\Thonny\DLLs\is-DFRP5.tmp

Windows Analysis Report
https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\future.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\future.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\phello.foo.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\phello.foo.cpython-310.pyc.1826913686720

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_aix_support.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_aix_support.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_bootsubprocess.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_bootsubprocess.cpython-310.pyc.1826913686832

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_collections_abc.cpython-310.pyc.1826901551136

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_compat_pickle.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_compat_pickle.cpython-310.pyc.1826913686832

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_compression.cpython-310.pyc.1826913678176

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_markupbase.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_markupbase.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_osx_support.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_osx_support.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_py_abc.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_py_abc.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_pydecimal.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_pydecimal.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_pyio.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_pyio.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_sitebuiltins.cpython-310.pyc.1826901991056

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_strptime.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_strptime.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_threading_local.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_threading_local.cpython-310.pyc.1826913687168

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_weakrefset.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\_weakrefset.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\abc.cpython-310.pyc.1826901545232

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\aifc.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\aifc.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\antigravity.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\antigravity.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\argparse.cpython-310.pyc.1826913151440

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\ast.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\ast.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\asynchat.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\asynchat.cpython-310.pyc.1826913918416

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\asyncore.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\asyncore.cpython-310.pyc.1826913925040

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\base64.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\base64.cpython-310.pyc.1826913925040

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\bdb.cpython-310.pyc (copy)

C:\Users\user\AppData\Local\Programs\Thonny\Lib\pycache\bdb.cpython-310.pyc.1826913925040

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.3	true	false	high
objects.githubusercontent.com	185.199.109.133	true	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cloud.google.com/appengine/docs/standard/runtimes	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue36817)	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/pylint-dev/pylint/issues/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/benjaminp/six.	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.unicode.org/book/ch03.pdf	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/a/42047820/261181	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/pip/issues	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://specifications.freedesktop.org/basedir-spec/basedir-spec-	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0263/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pylint-dev/pylint/issues/9138	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/guides/tool-recommendations/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/a/13520271/261181	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/astral-sh/ruff/issues/8946.	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ActiveState/appdirs/issues/79	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/32426250/python-documentation-and-or-lack-thereof-e-g-keyboard-e	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cloud.google.com/appengine/docs/python/urlfetch	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/pypa/setuptools/workflows/tests/badge.svg	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002530000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000000.1762876386.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false		high
https://blog.jaraco.com/skeleton	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gist.github.com/giststhebearbear/4145811	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tkinter.unpythonic.net/wiki/VerticalScrolledFrame	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/psf/requests/issues/1084	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wiki.tcl.tk/44444	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/questions/69897842/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://../package_name-0.1.2.tar.gz	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/mypy/issues/10559	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/core-metadata/#description	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://w.wiki/Qai	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue36054.	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://httpbin.org/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pylint-dev/astroid/issues/2273	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/psf/requests/issues/3490	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/benjaminp/six/blob/master/LICENSE	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc3986#section-5.2.4	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://stackoverflow.com/questions/22907200/remap-default-keybinding-in-tkinter	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/eliben/pycparser/issues/61)	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-hyper/rfc3986	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://brew.sh	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue33656	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wiki.debian.org/XDGBaseDirectorySpecification#state	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel/pull/289	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/eliben/pycparser	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pygments/pygments/issues	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pylint-dev/pylint/issues/2610	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0672/#confusing-features	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/platformdirs/platformdirs/actions/workflows/check.yml/badge.svg	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pylint.readthedocs.io/en/latest/whatsnew/2/2.14/summary.html#removed-checkers	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pepy.tech/project/tox-uv	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.python.org/pypi/pylint	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pylint-dev/pylint/issues/3822	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue10272	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue13936	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/deprecated/easy_install.html	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://encoding.spec.whatwg.org/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/specifications/core-metadata/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pylint-dev/pylint/pull/3309#discussion_r576683109	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/firacode/6.2.0/woff/FiraCode-Regular.woff	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.python.org/pypi/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://kiwiirc.com/nextclient/#ircs://irc.libera.chat:	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/36134072/setprocessdpiaware-seems-not-to-work-under-windows-10	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.tcl.tk/man/tcl8.6/TkCmd/font.htm#M26	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://opensource.org/licenses/MIT	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tcl.tk/man/tcl8.6/TkCmd/chooseDirectory.htm	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://thonny.org0	wget.exe, 00000002.00000003.1743083361.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1748002516.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.1743083361.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/651	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue22384	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0008/#module-level-dunder-names	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html#re.sub	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0621/#license	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	thonny-4.1.6.exe, 00000004.00000003.1761156667.0000000002628000.00000004.00001000.00020000.00000000.sdmp, thonny-4.1.6.exe, 00000004.00000003.1761524639.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pip.pypa.io/en/latest/user_guide/#changes-to-the-pip-dependency-resolver-in-20-3-2020	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://opensource.org/licenses/MITVolby	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pip.pypa.io/en/latest/development/release-process/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/pip.svg	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/shutil.html#shutil.move	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue34921	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.activestate.com/recipes/578513-get-memory-usage-of-windows-processes-using-getpro/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ntoll/uflash/blob/master/uflash.py	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://w3c.github.io/html/sec-forms.html#multipart-form-data	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyparsing/pyparsing/wiki	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/deprecated/easy_install.html#custom-installation-locations	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pypi.org/p/twine)	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pygments.org/docs/styles/#getting-a-list-of-available-styles).	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pyopenssl.org	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.org/project/pip/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000704D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/stable/history.html	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/questions/2113822/python-getting-filename-case-as-stored-in-windows/211497	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://effbot.org/zone/tkinter-autoscrollbar.htm	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pythonhosted.org/%s/	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/thonny/thonny/issues/840)	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://six.readthedocs.io/.	thonny-4.1.6.tmp, 00000005.00000003.2915368900.000000000783F000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.109.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false
140.82.121.3	github.com	United States		36459	GITHUBUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554902
Start date and time:	2024-11-13 07:37:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@9/2655@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Users\user\AppData\Local\Temp\is-963LH.tmp\thonny-4.1.6.tmp
File Type:	Unicode text, UTF-8 text, with very long lines (349)
Category:	dropped
Size (bytes):	80311
Entropy (8bit):	5.1901750194071585
Encrypted:	false
SSDEEP:	1536:4DT/1dYG/ZOaLPDa8bpM7aAR8mvB2uYk+wtuk0V3:4X/1dTF0b8mvouT+IuXV3
MD5:	CF762582FC5457CF43D704871D570BF8
SHA1:	77234F74F3A397CF1CB90139DD3F6A5790AC8077
SHA-256:	348739BE750A25CF5B70C705F741E2F24347F38C89742D18DAA01920E292ADA1
SHA-512:	E3792A122976D65179038A2181B7F5E8856ABE6137BFE6B0E5BCDF235221A6A630FEB57E6EDABB37E62BAB3CD53EADEBD81B397AAA72DE00CD908142392B149A
Malicious:	false
Reputation:	low
Preview:	===============.Version history.===============..4.1.6 (2024-09-11).==================.* Make macOS installer work in Sequoia.* Add more entitlements for macOS app bundle (may fix problems with programs using camera or microphone).* New and updated languages thanks to the translators at POEditor..4.1.5 (2024-09-10).==================.* Fix handling nulls in PyPI metadata (fixes installing some PyPI packages).* Work around dialogs getting stuck after minimizing windows, #3068.* Fix too eager instrumentation of MicroPython code, #3043.* Fix installing package from local file..4.1.4 (2023-11-19).==================.* Fix regression in MicroPython package installation, #2979.* Add better error message for externally managed environments, #3009.* Fix package installation in remote virtual environments.* Update Raspberry Pi detection.* Silence "bad-option-value"-s given by Pylint 3..4.1.3 (2023-09-28).==================.* Fix first run crash on macOS (#2860).* Fix package upgrade and uninstal

Process:	C:\Users\user\Desktop\download\thonny-4.1.6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3211056
Entropy (8bit):	6.333652427401503
Encrypted:	false
SSDEEP:	49152:SWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYR:etLutqgwh4NYxtJpkxhGj333Tq
MD5:	D79DEEDB40FBBA20411722A13B506128
SHA1:	9E08B21922B83CC8F942A30FA7455F0B30325A45
SHA-256:	E2F9EC5F85EA6AC36A9E152287F117546E30DC522F61FACD300E136B4FF5D49E
SHA-512:	E7A8B5D32E9CE9FE1461BB24C1D2CF3E80E94269C8AAF65D16BEE656D9084E6FA823FAEBA16AEF6934A3C3767D07414426896DF447A3AC98933D011517412DB1
Malicious:	false
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.......1...@......@....................-.......-..9....................0.0-...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (538), with CRLF line terminators
Category:	modified
Size (bytes):	37082
Entropy (8bit):	2.4488216423273714
Encrypted:	false
SSDEEP:	384:U9TYblBuFY/uTQbY+zqmi4MaSj1Q3wI7m:U9csrQbLqFj1n
MD5:	DC09D8C8E788CA738922AD811385EE40
SHA1:	5316F6F66FA5BC5EE6D2A2F7F73DAF781608E2A9
SHA-256:	48BF4A85440A46F37A428EED408D12C71CBEBB73EE4236906C7B4585ABA02D80
SHA-512:	703891E2C4A615B023F0A8248614A939D1363685A6BF4EB7C9238CD7DEAE670C7A827DAE2B32A447C81D02159CBDC948B47A1DA5E256F9ED920050C241A293D7
Malicious:	false
Reputation:	low
Preview:	--2024-11-13 01:38:00-- https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe..Resolving github.com (github.com)... 140.82.121.3..Connecting to github.com (github.com)\|140.82.121.3\|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/163728962/eefec4ff-bfdd-409f-98d7-9262065da9c6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241113%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241113T063752Z&X-Amz-Expires=300&X-Amz-Signature=d5bed8387d507ef1aa658649232a12aedc4c0209003d55207445aafaab850738&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dthonny-4.1.6.exe&response-content-type=application%2Foctet-stream [following]..--2024-11-13 01:38:01-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/163728962/eefec4ff-bfdd-409f-98d7-9262065da9c6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-C

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23309536
Entropy (8bit):	7.991297812258625
Encrypted:	true
SSDEEP:	393216:j7FKBEPJd27cyQE9ODd95vyjo+c72WNCZ0B/rBisAhWdxVU47bmGvu+Aff:j7FKBERs7z9uZKjoD+algfhW3VUwyGvo
MD5:	E98BBBA2ED9D7CE96F1586A259C8475D
SHA1:	3016C995DFEA20E8D03DB9210F734F4069D7CC38
SHA-256:	CEBB7723B7ACC5876BC1E023D136A5816ED1AAA390F0D3D2DF5DE0F75720A69C
SHA-512:	14C9D70096CB0EC96F7614C611B5C981AB9CD3F3A1838D6925983FC558F49A025354FBACDC0424B7A2081E4620A24D589540CA5EDB21D338EBDD4229F34C33B2
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................c...@......@...................@....... .......p................c.0-...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T07:38:21.797965+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49732	TCP
2024-11-13T07:38:40.778388+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	53463	TCP
2024-11-13T07:38:43.491076+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	53464	TCP

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 07:38:01.504692078 CET	50301	53	192.168.2.4	1.1.1.1
Nov 13, 2024 07:38:01.511667013 CET	53	50301	1.1.1.1	192.168.2.4
Nov 13, 2024 07:38:02.644511938 CET	61802	53	192.168.2.4	1.1.1.1
Nov 13, 2024 07:38:02.652568102 CET	53	61802	1.1.1.1	192.168.2.4
Nov 13, 2024 07:38:35.855433941 CET	53	62037	162.159.36.2	192.168.2.4
Nov 13, 2024 07:38:36.512171984 CET	52128	53	192.168.2.4	1.1.1.1
Nov 13, 2024 07:38:36.519388914 CET	53	52128	1.1.1.1	192.168.2.4