24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 07e019e4309c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 07e019e4309c…. Malware family: Yogi.Generic. Threat score 100/100. 5/25 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931"],"about":{"@type":"SoftwareApplication","name":"07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1fd0,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "flush() method to finish the compression process." (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.63BE0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63BE0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63BE0000.00000004.mdmp") Found string "Finish the compression process." (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.63BE0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63BE0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63BE0000.00000004.mdmp") Found string "Invalid compression preset: %u" (Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp") Found string "points in compression, you may have a flaky memory system." (Source: "00000000-00001812.00000000.110434.1271D000.00000002.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00001812.00000000.110434.613D0000.00000004.mdmp, 00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.613D0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.613D0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found string "_compression" (Source: "00000000-00001812.00000000.110434.63200000.00000004.mdmp, 00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000000.110434.63BE0000.00000004.mdmp, 00000000-00001812.00000001.112355.63200000.00000004.mdmp, 00000000-00001812.00000001.112355.63BE0000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.63BE0000.00000004.mdmp") Found string "ZipFile" (Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "BadZipFile" (Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "If it is a path, the file will be opened and closed by ZipFile." (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "compression: ZIP_STORED (no compression), ZIP_DEFLATED (requires zlib)," (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "allowZip64: if True ZipFile will create files with ZIP64 extensions when" (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "compresslevel: None (default for the given compression type) or an integer" (Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string ">>> zf = ZipFile(data, 'w')" (Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found string "PyZipFile" (Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.63BE0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63BE0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63BE0000.00000004.mdmp") Found string "LargeZipFile" (Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.63BE0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63BE0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63BE0000.00000004.mdmp")26:T1142,Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-24360357546") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\mikameta'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-47315244238") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-70471610547") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-93035635503") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-115132073645") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-137643881874") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-159558785729") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-180882797467") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-202447675124") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""" (Indicator: "add-mppreference"; Source: "00000000-00001812-00000C46-225986429285") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"" (Indicator: "add-mppreference"; Source: "00000000-00008188-00000C46-1562410058") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\mikameta'"" (Indicator: "add-mppreference"; Source: "00000000-00004984-00000C46-1550065556") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\"" (Indicator: "add-mppreference"; Source: "00000000-00008164-00000C46-1587872430"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007312-00000C46-1525928198"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"" (Indicator: "add-mppreference"; Source: "00000000-00004360-00000C46-1698859338"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"" (Indicator: "add-mppreference"; Source: "00000000-00002972-00000C46-1599653562"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"" (Indicator: "add-mppreference"; Source: "00000000-00006152-00000C46-1515741564"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"" (Indicator: "add-mppreference"; Source: "00000000-00003340-00000C46-1739480772"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007752-00000C46-1611479028"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\mikameta'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; File: "cmd.exe")27:Tfd1,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp, 00000000-00001812.00000001.112355.03452000.00000002.mdmp, 00000000-00001812.00000001.112355.0AF1E000.00000002.mdmp, 00000000-00001812.00000001.112355.17A33000.00000002.mdmp, 00000000-00001812.00000001.112355.18B66000.00000002.mdmp, 00000000-00001812.00000002.114275.0B2BC000.00000002.mdmp, 00000000-00001812.00000002.114275.0BEC3000.00000002.mdmp, 00000000-00001812.00000002.114275.123B9000.00000002.mdmp, 00000000-00001812.00000002.114275.127D4000.00000002.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.18773000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001812.00000000.110434.0BE97000.00000002.mdmp, 00000000-00001812.00000000.110434.1271D000.00000002.mdmp, 00000000-00001812.00000001.112355.03452000.00000002.mdmp, 00000000-00001812.00000001.112355.0AF1E000.00000002.mdmp, 00000000-00001812.00000001.112355.17A33000.00000002.mdmp, 00000000-00001812.00000001.112355.18B66000.00000002.mdmp, 00000000-00001812.00000002.114275.0B2BC000.00000002.mdmp, 00000000-00001812.00000002.114275.0BEC3000.00000002.mdmp, 00000000-00001812.00000002.114275.123B9000.00000002.mdmp, 00000000-00001812.00000002.114275.127D4000.00000002.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.18773000.00000002.mdmp") Found reference to API "BatchedWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000001.112355.0AF1E000.00000002.mdmp, 00000000-00001812.00000002.114275.0B2BC000.00000002.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp") Found reference to API "_WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.63CE0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.63CE0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.63CE0000.00000004.mdmp") Found reference to API "WaitForSingleObjectr" (Indicator: "WaitForSingleObject"; Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp")28:T7ef,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000001.112355.0AF1E000.00000002.mdmp, 00000000-00001812.00000002.114275.0BEC3000.00000002.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001812.00000000.110434.63300000.00000004.mdmp, 00000000-00001812.00000001.112355.03452000.00000002.mdmp, 00000000-00001812.00000001.112355.0AF1E000.00000002.mdmp, 00000000-00001812.00000002.114275.0B2BC000.00000002.mdmp, 00000000-00001812.00000002.114275.0BEC3000.00000002.mdmp, 00000000-00001812.00000002.114275.127D4000.00000002.mdmp, 00000000-00001812.00000002.114275.63300000.00000004.mdmp")29:T101a,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_wmi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005192-00000BC0-682861146") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931.bin") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00001812.00000000.110434.63200000.00000004.mdmp, 00000000-00001812.00000001.112355.63200000.00000004.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.0330B000.00000002.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00001812.00000000.110434.63400000.00000004.mdmp, 00000000-00001812.00000001.112355.0330B000.00000002.mdmp, 00000000-00001812.00000001.112355.63400000.00000004.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.63400000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.642E0000.00000004.mdmp, 00000000-00001812.00000001.112355.0330B000.00000002.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.642E0000.00000004.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.642E0000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.0330B000.00000002.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001812.00000000.110434.638E0000.00000004.mdmp, 00000000-00001812.00000000.110434.642E0000.00000004.mdmp, 00000000-00001812.00000001.112355.0330B000.00000002.mdmp, 00000000-00001812.00000001.112355.638E0000.00000004.mdmp, 00000000-00001812.00000001.112355.642E0000.00000004.mdmp, 00000000-00001812.00000002.114275.180F6000.00000002.mdmp, 00000000-00001812.00000002.114275.638E0000.00000004.mdmp, 00000000-00001812.00000002.114275.642E0000.00000004.mdmp")2a:Ta58,">> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> path.name" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Heuristic match: "socket.py" Heuristic match: "random.py" Heuristic match: ")shuffle list x in place, and return none.re" Pattern match: "https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64" Pattern match: "http://en.wikipedia.org/wiki/triangular_distribution" Heuristic match: "