26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample ba2085d015f0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ba2085d015f0…. Malware family: Yogi.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f"],"about":{"@type":"SoftwareApplication","name":"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T19c1,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "Failed to extract %s: decompression resulted in return code %d!" (Source: "00000000-00004856.00000000.237440.99AEE000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00004856.00000000.237440.99AEE000.00000002.mdmp") Found string "The dictionary can be used for compression or decompression, and can be shared" (Source: "00000000-00004856.00000000.237440.C8E30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.C8E30000.00000004.mdmp, 00000000-00004856.00000001.237788.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.F25EA000.00000002.mdmp") Found string "compression" (Source: "00000000-00004856.00000000.237440.C8E30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000000.237440.C9510000.00000004.mdmp, 00000000-00004856.00000000.237440.C9810000.00000004.mdmp, 00000000-00004856.00000001.237788.C8E30000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.C9810000.00000004.mdmp, 00000000-00004856.00000001.237788.EC4D2000.00000002.mdmp, 00000000-00004856.00000001.237788.F032E000.00000002.mdmp, 00000000-00004856.00000001.237788.F25EA000.00000002.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "*level* is an optional int specifying the compression level to use," (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "*options* is an optional dict for advanced compression parameters." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "See CompressionParameter and DecompressionParameter for the possible" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9610000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp, 00000000-00004856.00000001.237788.C9654000.00000004.mdmp, 00000000-00004856.00000001.237788.F2DF7000.00000002.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9610000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp, 00000000-00004856.00000001.237788.C9654000.00000004.mdmp, 00000000-00004856.00000001.237788.F2DF7000.00000002.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9510000.00000004.mdmp, 00000000-00004856.00000000.237440.C9610000.00000004.mdmp, 00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp, 00000000-00004856.00000001.237788.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.C9654000.00000004.mdmp, 00000000-00004856.00000001.237788.F2DF7000.00000002.mdmp, 00000000-00004856.00000001.237788.F922E000.00000002.mdmp") Found string "*level* is an int specifying the compression level to use, defaulting to" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C900A000.00000004.mdmp") Found string "*options* is a dict object that contains advanced compression" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000000.237440.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.C900A000.00000004.mdmp, 00000000-00004856.00000001.237788.C9510000.00000004.mdmp") Found string "For incremental compression, use a ZstdCompressor instead." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C900A000.00000004.mdmp") Found string "and 9 specifying the level of compression: 1 produces the least" (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C900A000.00000004.mdmp") Found string "compression, and 9 (default) produces the most compression." (Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp, 00000000-00004856.00000001.237788.C900A000.00000004.mdmp") Found string "Interface to the libbzip2 compression library." (Source: "00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp") Found string "(de)compression, and functions for one-shot (de)compression." (Source: "00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp") Found string "aiohttp.compression_utils" (Source: "00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.CCDD0000.00000004.mdmp, 00000000-00004856.00000001.237788.CD1B0000.00000004.mdmp") Found string "compression._common" (Source: "00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000000.237440.C9810000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9810000.00000004.mdmp") Found string "compression.zstd" (Source: "00000000-00004856.00000000.237440.C9030000.00000004.mdmp, 00000000-00004856.00000000.237440.C9510000.00000004.mdmp, 00000000-00004856.00000000.237440.C9810000.00000004.mdmp, 00000000-00004856.00000001.237788.C9030000.00000004.mdmp, 00000000-00004856.00000001.237788.C9510000.00000004.mdmp, 00000000-00004856.00000001.237788.C9810000.00000004.mdmp, 00000000-00004856.00000001.237788.CD1B0000.00000004.mdmp")28:Tbdb,">> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> path.name" Pattern match: "https://docs.python.org/3/library/multiprocessing.html" Pattern match: "https://json.org" Heuristic match: "copyright (c) 1999-2000, marc-andre lemburg; mailto:mal@lemburg.com" Heuristic match: "copyright (c) 2000-2010, egenix.com software gmbh; mailto:info@egenix.com" Heuristic match: "return hash((self.type,self.message,self.filename,self.li" Pattern match: "https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64" Heuristic match: "compression\_common\__init__.py" Heuristic match: "compression\_common\_streams.py" Heuristic match: "compression\zstd\__init__.py" Heuristic match: "compression\zstd\_zstdfile.py" Heuristic match: "bz2file.name" Heuristic match: "compression\__init__.py" Heuristic match: "lzmafile.name" Heuristic match: "lzma.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\compression\zstd\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\compression\zstd\_zstdfile.py" Heuristic match: "zstdfile.name" Heuristic match: "subprocess.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\subprocess.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\ctypes\wintypes.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\ctypes\_layout.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\_py_warnings.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\contextlib.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\annotationlib.py" Heuristic match: "locale.py" Heuristic match: "signal.py" Heuristic match: "warnings.py" Heuristic match: "_py_warnings.py" Heuristic match: "contextlib.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\dis.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\ast.py" Heuristic match: "es.py" Heuristic match: "ctypes\wintypes.py" Heuristic match: "ctypes\_layout.py" Heuristic match: "inspect.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\_opcode_metadata.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\importlib\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\importlib\_bootstrap.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\tokenize.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\opcode.py" Heuristic match: "annotationlib.py" Heuristic match: "parameter.name" Heuristic match: "dis.py" Heuristic match: "ast.py" Pattern match: "https://github.com/python/importlib_metadata/wiki/development-methodology" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\importlib\_bootstrap_external.py" Pattern match: "https://peps.python.org/pep-0205/" Heuristic match: "bytecode.info" Heuristic match: "opcode.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\token.py" Heuristic match: "_opcode_metadata.py" Heuristic match: "importlib\__init__.py" Heuristic match: "linecache.py" Heuristic match: "tokenize.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\importlib\util.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\zipfile\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\importlib\_abc.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\zipfile\_path\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\pathlib\__init__.py" Heuristic match: "filename.py" Heuristic match: "token.py" Heuristic match: "weakref.py" Heuristic match: "pyi_rth_multiprocessing.py" Heuristic match: "zipfile\__init__.py" Heuristic match: "_zipwritefile.name" Heuristic match: "zipfile\_path\__init__.py" Heuristic match: "c:\users\hapubws\appdata\local\temp\_mei64442\glob.py" Heuristic match: "_abc.py" Heuristic match: "importlib\_abc.py" Heuristic match: "path.name" Heuristic match: "glob.py" Heuristic match: "pathlib\__init__.py" Heuristic match: "purepath.name" Heuristic match: "path.info"4f:T929d,Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00004856.00000000.237440.C8E30000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00004856.00000000.237440.C8E30000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00004856.00000000.237440.C8F30000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00004856.00000000.237440.C9510000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00004856.00000000.237440.C9610000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00004856.00000000.237440.C9610000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00004856.00000000.237440.C9610000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00004856.00000000.237440.C9810000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00004856.00000000.237440.C9810000.00000004.mdmp") Found URL "http://196.251.107.104/slots_aio_cracked.zipforkawarelocal.__init__..close" - Source: "00000000-00004856.00000000.237440.C9A10000.00000004.mdmp") Found URL "http://196.251.107.104/tpremsetupweb-x64_6.8.1.exehttp://196.251.107.104/discordnitro_gen_v5.2.exefast" - Source: "00000000-00004856.00000000.237440.C9A10000.00000004.mdmp") Found URL "http://196.251.107.104/netghost.ziptdesktop_decrypter.decrypterregister_adapters_and_converterso" - Source: "00000000-00004856.00000000.237440.C9A10000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00004856.00000000.237440.C9A10000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00004856.00000000.237440.C9B52000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00004856.00000000.237440.C9F10000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.same" - Source: "00000000-00004856.00000000.237440.C9F10000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.pmem(rss," - Source: "00000000-00004856.00000000.237440.C9F10000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00004856.00000000.237440.CA010000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764.>>>" - Source: "00000000-00004856.00000000.237440.CA010000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00004856.00000000.237440.CA010000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875.see:" - Source: "00000000-00004856.00000000.237440.CA110000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00004856.00000000.237440.CA110000.00000004.mdmp") Found URL "https://github.com/telegramdesktop/tdesktop/blob/bec39d89e19670eb436dc794a8f20b657cb87c71/telegram/sourcefiles/ui/image/image.cpp" - Source: "00000000-00004856.00000000.237440.CA110000.00000004.mdmp") Found URL "https://github.com/lonamiwebs/telethon/issues/1337import" - Source: "00000000-00004856.00000000.237440.CA110000.00000004.mdmp") Found URL "https://core.telegram.org/method/phone.joingroupcall)printpost11xp64xpmediasb'>2000origincdnfile_clssystemreleaseator&&&&&modeldevicenodefclsfinalliteraltypeftuple_ndeque9fclsacttextiovfystemanystrfodeneverfeleasenewtype&&&&&&&device_fersiontextfachinetypeis&&&&&&machinequnpackattrhtmlutils" - Source: "00000000-00004856.00000000.237440.CA110000.00000004.mdmp") Found URL "https://core.telegram.org/method/phone.joingroupcall)the" - Source: "00000000-00004856.00000000.237440.CA410000.00000004.mdmp") Found URL "https://core.telegram.org/api/files" - Source: "00000000-00004856.00000000.237440.CA410000.00000004.mdmp") Found URL "https://core.telegram.org/mtproto/service_messages" - Source: "00000000-00004856.00000000.237440.CA7BC000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/parsing.html" - Source: "00000000-00004856.00000000.237440.CA822000.00000004.mdmp") Found URL "https://core.telegram.org/api/config" - Source: "00000000-00004856.00000000.237440.CAD10000.00000004.mdmp") Found URL "https://core.telegram.org/animated_stickers)invalid" - Source: "00000000-00004856.00000000.237440.CAD10000.00000004.mdmp") Found URL "https://core.telegram.org/cdn" - Source: "00000000-00004856.00000000.237440.CAD10000.00000004.mdmp") Found URL "https://www.telegram.org/faq_spamnobody" - Source: "00000000-00004856.00000000.237440.CAE10000.00000004.mdmp") Found URL "https://core.telegram.org/api/files" - Source: "00000000-00004856.00000000.237440.CAF10000.00000004.mdmp") Found URL "https://core.telegram.org/bots/api" - Source: "00000000-00004856.00000000.237440.CAF10000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/parsing.html" - Source: "00000000-00004856.00000000.237440.CB510000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00004856.00000001.237788.C8E30000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00004856.00000001.237788.C8E30000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00004856.00000001.237788.C8F5A000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.split" - Source: "00000000-00004856.00000001.237788.C9510000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.comaddtrust" - Source: "00000000-00004856.00000001.237788.C9654000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.comdict..close" - Source: "00000000-00004856.00000001.237788.C9A10000.00000004.mdmp") Found URL "http://196.251.107.104/tpremsetupweb-x64_6.8.1.exehttp://196.251.107.104/discordnitro_gen_v5.2.exeusers\hapubws\appdata\local\telegram" - Source: "00000000-00004856.00000001.237788.C9A10000.00000004.mdmp") Found URL "http://196.251.107.104/netghost.ziptdesktop_decrypter.decrypterregister_adapters_and_converterso" - Source: "00000000-00004856.00000001.237788.C9A10000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00004856.00000001.237788.C9A10000.00000004.mdmp") Found URL "https://www.thawte.com/cps28e" - Source: "00000000-00004856.00000001.237788.C9BAD000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/9;" - Source: "00000000-00004856.00000001.237788.C9BAD000.00000004.mdmp") Found URL "http://www.geotrust.com/resources/cpsthawte," - Source: "00000000-00004856.00000001.237788.C9BAD000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004856.00000001.237788.C9BD9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10g" - Source: "00000000-00004856.00000001.237788.C9BD9000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004856.00000001.237788.C9BD9000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-539q/" - Source: "00000000-00004856.00000001.237788.C9BD9000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cpst%ogge/cdiuud2uud1uuyou" - Source: "00000000-00004856.00000001.237788.C9BDF000.00000004.mdmp") Found URL "https://core.telegram.org/api/updates.example" - Source: "00000000-00004856.00000001.237788.C9C78000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00004856.00000001.237788.C9C78000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00004856.00000001.237788.C9D49000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00004856.00000001.237788.C9D6C000.00000004.mdmp") Found URL "https://github.com/aio-libs/aiohttp/pull/1453where" - Source: "00000000-00004856.00000001.237788.C9DD8000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00004856.00000001.237788.C9E18000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00004856.00000001.237788.C9E18000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/miller%e2%80%93rabin_primality_test:param" - Source: "00000000-00004856.00000001.237788.C9E18000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-5330313rtq" - Source: "00000000-00004856.00000001.237788.C9E48000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00004856.00000001.237788.C9F10000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.same" - Source: "00000000-00004856.00000001.237788.C9F10000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html.pmem(rss," - Source: "00000000-00004856.00000001.237788.C9F10000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00004856.00000001.237788.CA010000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764.>>>" - Source: "00000000-00004856.00000001.237788.CA010000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00004856.00000001.237788.CA010000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875.see:" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://github.com/telegramdesktop/tdesktop/blob/bec39d89e19670eb436dc794a8f20b657cb87c71/telegram/sourcefiles/ui/image/image.cpp" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://github.com/lonamiwebs/telethon/issues/1337import" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://github.com/lonamiwebs/telethon/issues/4050" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://core.telegram.org/method/phone.joingroupcall)printpost11xp64xpmediasb'>2000origincdnfile_clssystemreleaseator&&&&&modeldevicenodedclsfinalliteraltypedtuple_ndeque9dclsacttextiovdystemanystrdodeneverdeleasenewtype&&&&&&&device_dersiontextdachinetypeis&&&&&&machinequnpackattrhtmlnba" - Source: "00000000-00004856.00000001.237788.CA110000.00000004.mdmp") Found URL "https://core.telegram.org/method/phone.joingroupcall)the" - Source: "00000000-00004856.00000001.237788.CA410000.00000004.mdmp") Found URL "https://core.telegram.org/api/files" - Source: "00000000-00004856.00000001.237788.CA410000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/http://s2.symcb.comsymantecpki-1-533usertrust" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl1.2.840.113549.1.1.51.3.6.1.5.5.7.1.1k" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtepca-g3.crl-m" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/ure" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlcomodo" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "https://www.digicert.com/cps04020*0(https://www.digicert.com/cps0*0(" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crlgo" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdroot-g2.crl0&0$http://ocsp.digicert.com0/0-!http://ocsp.globalsign.com/rootr10'0%http://s1.symcb.com/pca3-g5.crl0&0$http://ocsp.digicert.com" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0/0-!http://ocsp.globalsign.com/rootr1n,?)cf0-0+%http://g1.symcb.com/crls/gtglobal.crl1.3.6.1.5.5.7.3.21.3.6.1.5.5.7.3.12.16.840.1.113730.4.1" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com&" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpaglobalsign" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa[0y0w0u" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifdigicert" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://s2.symcb.coma" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://g2.symcb.comtrusted" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://ocsp.thawte.comaddtrust" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://g2.symcb.com2.5.29.102&,lq8" - Source: "00000000-00004856.00000001.237788.CA62F000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004856.00000001.237788.CA6C6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlmd" - Source: "00000000-00004856.00000001.237788.CA6C6000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crlentrust" - Source: "00000000-00004856.00000001.237788.CA6C6000.00000004.mdmp") Found URL "http://repository.swisssign.com/xj'oalling" - Source: "00000000-00004856.00000001.237788.CA6CA000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/http_public_key_pinningresolver" - Source: "00000000-00004856.00000001.237788.CA6CA000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00004856.00000001.237788.CA84E000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00004856.00000001.237788.CA84E000.00000004.mdmp") Found URL "http://python.org/')" - Source: "00000000-00004856.00000001.237788.CA874000.00000004.mdmp") Found URL "https://www.python.org/)" - Source: "00000000-00004856.00000001.237788.CA874000.00000004.mdmp") Found URL "https://t.me/botfather>" - Source: "00000000-00004856.00000001.237788.CA874000.00000004.mdmp") Found URL "https://core.telegram.org/widgets/login.if" - Source: "00000000-00004856.00000001.237788.CA874000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comdcreate" - Source: "00000000-00004856.00000001.237788.CA880000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc3986" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://example.com:8080" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://example.com:80" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://example.com.:80" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "https://127.0.0.1:8443" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "https://[::1]:8443" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://[::1]" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crtshold'," - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "https://github.com/requests/requests/blob/v2.18.4/requests/auth.pywith" - Source: "00000000-00004856.00000001.237788.CABD9000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004856.00000001.237788.CAC15000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/digicert" - Source: "00000000-00004856.00000001.237788.CAC15000.00000004.mdmp") Found URL "https://tl.telethon.dev/types/message_action.html>" - Source: "00000000-00004856.00000001.237788.CAC70000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004856.00000001.237788.CAC70000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcfrtqd" - Source: "00000000-00004856.00000001.237788.CAC70000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004856.00000001.237788.CACEA000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10d%uud'uu*zo" - Source: "00000000-00004856.00000001.237788.CACEA000.00000004.mdmp") Found URL "https://bugs.python.org/issue37179*" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "https://github.com/python/cpython/pull/28073you" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "https://docs.aiohttp.org/en/stable/client_advanced.html" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "https://github.com/aio-libs/aiohttp/discussions/6044geotrust" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "https://github.com/lonamiwebs/telethon/issues/4050>" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004856.00000001.237788.CACF5000.00000004.mdmp") Found URL "https://core.telegram.org/api/files" - Source: "00000000-00004856.00000001.237788.CAF10000.00000004.mdmp") Found URL "https://core.telegram.org/bots/api" - Source: "00000000-00004856.00000001.237788.CAF10000.00000004.mdmp") Found URL "https://core.telegram.org/cdnconstructor" - Source: "00000000-00004856.00000001.237788.CB310000.00000004.mdmp") Found URL "https://docs.telethon.dev/en/stable/concepts/entities.html" - Source: "00000000-00004856.00000001.237788.CB310000.00000004.mdmp") Found URL "http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdfconstructor" - Source: "00000000-00004856.00000001.237788.CB410000.00000004.mdmp") Found URL "https://tls.mbed.org/public/wschindler-rsa_timing_attack.pdf:return:" - Source: "00000000-00004856.00000001.237788.CB510000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00004856.00000001.237788.CB510000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00004856.00000001.237788.CB510000.00000004.mdmp") Found URL "https://html.spec.whatwg.org/multipage/parsing.html" - Source: "00000000-00004856.00000001.237788.CB510000.00000004.mdmp") Found URL "https://core.telegram.org/cdnd" - Source: "00000000-00004856.00000001.237788.CB610000.00000004.mdmp") Found URL "https://comeoncodeon.wordpress.com/2010/09/18/pollard-rho-brent-integer-factorization/.:param" - Source: "00000000-00004856.00000001.237788.CB610000.00000004.mdmp") Found URL "https://core.telegram.org/mtproto/description).this" - Source: "00000000-00004856.00000001.237788.CBA00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/blinding_%28cryptography%29performs" - Source: "00000000-00004856.00000001.237788.CBA00000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/blinding_%28cryptography%29" - Source: "00000000-00004856.00000001.237788.CBA00000.00000004.mdmp") Found URL "https://core.telegram.org/mtproto/description" - Source: "00000000-00004856.00000001.237788.CBB00000.00000004.mdmp") Found URL "https://core.telegram.org/mtproto/description).this" - Source: "00000000-00004856.00000001.237788.CBB00000.00000004.mdmp") Found URL "https://telegram.org/blog/autodelete-inv2" - Source: "00000000-00004856.00000001.237788.CBB00000.00000004.mdmp") Found URL "https://telegram.org/blog/supergroups5kwhether" - Source: "00000000-00004856.00000001.237788.CBB00000.00000004.mdmp") Found URL "https://core.telegram.org/api/bots/games>" - Source: "00000000-00004856.00000001.237788.CBC00000.00000004.mdmp") Found URL "https://core.telegram.org/api/payments>" - Source: "00000000-00004856.00000001.237788.CBC00000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc3986" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://example.com:8080" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://example.com:80" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "https://127.0.0.1:8443" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "https://[::1]:8443" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://[::1]" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://example.com/?a=1&b=2')>>>" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://example.com/?a=3&b=2&c=4')auto_excforce_kw_onlygetstate_setstateattrs..wrapmaybe_clsnwarning" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "ftp://ftp.unicode.org/.the" - Source: "00000000-00004856.00000001.237788.CBD00000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crlesssigncertificatedecodeex0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0<0:0200$https://www.alphassl.com/repository/0=0;0301%https://certs.godaddy.com/repository/verisign" - Source: "00000000-00004856.00000001.237788.CBE05000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl*%vj.1.2.840.113549.1.9.16.2.3verisign" - Source: "00000000-00004856.00000001.237788.CBE05000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl1.2.840.113549.1.9.16.2.12eouud(uut" - Source: "00000000-00004856.00000001.237788.CBE05000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl" - Source: "00000000-00004856.00000001.237788.CBE05000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crtglobalsign" - Source: "00000000-00004856.00000001.237788.CBE05000.00000004.mdmp") Found URL "http://exampglobalsign" - Source: "00000000-00004856.00000001.237788.CBE96000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004856.00000001.237788.CBE96000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004856.00000001.237788.CBE96000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crli-^" - Source: "00000000-00004856.00000001.237788.CBE96000.00000004.mdmp") Found URL "https://t.me/botfather>" - Source: "00000000-00004856.00000001.237788.CBEE3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004856.00000001.237788.CBEE7000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004856.00000001.237788.CBEE7000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-5340@jd" - Source: "00000000-00004856.00000001.237788.CBEE7000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issuesstacklevelmodule" - Source: "00000000-00004856.00000001.237788.CC016000.00000004.mdmp") Found URL "http://example.com/?a=1&b=2')>>>" - Source: "00000000-00004856.00000001.237788.CCDD0000.00000004.mdmp") Found URL "http://example.com/?a=1&b=2&a=3&c=4')a" - Source: "00000000-00004856.00000001.237788.CCDD0000.00000004.mdmp") Found URL "http://python.org'" - Source: "00000000-00004856.00000001.237788.CCDD0000.00000004.mdmp") Found URL "http://python.org:80'," - Source: "00000000-00004856.00000001.237788.CCDD0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/asyncio-eventloop.htmlpath" - Source: "00000000-00004856.00000001.237788.CD0B0000.00000004.mdmp") Found URL "https://bugs.python.org/issue37179*" - Source: "00000000-00004856.00000001.237788.CD0B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/pull/28073*" - Source: "00000000-00004856.00000001.237788.CD0B0000.00000004.mdmp") Found URL "https://docs.aiohttp.org/en/stable/client_advanced.html" - Source: "00000000-00004856.00000001.237788.CD0B0000.00000004.mdmp") Found URL "https://github.com/aio-libs/aiohttp/discussions/6044d,uue(uudef" - Source: "00000000-00004856.00000001.237788.CD0B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/pull/118960" - Source: "00000000-00004856.00000001.237788.CD1B0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00004856.00000001.237788.CD1B0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/asyncio-eventloop.htmlpath" - Source: "00000000-00004856.00000001.237788.CD330000.00000004.mdmp") Found URL "https://github.com/lonamiwebs/telethon/issues/4050>" - Source: "00000000-00004856.00000001.237788.CD330000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issuesi0y;error_incompatible_with_global_short_name_registry_settingerror_insufficient_resource_for_specified_shared_section_sizeerror_system_integrity_supplemental_policy_not_authorizederror_cluster_resource_vetoed_move_not_enough_resources_on_destinationerror_cluster_resource_vetoed_move_not_enough_resources_on_sourceerror_miniversion_inaccessible_from_specified_transactionerror_ipsec_key_module_impersonation_negotiation_pendingerror_ipsec_ike_authorization_failure_with_optional_retryerror_ipsec_ike_strong_cred_authorization_and_certmap_failureerror_sxs_private_manifest_cross_path_with_reparse_pointerror_mrm_unsupported_file_type_for_load_unload_pri_fileerror_provision_optional_package_requires_main_package_provisionederror_deployment_failed_conflicting_mutable_package_directoryerror_package_lacks_capability_for_mandatory_startuptaskscomadmin_e_legacycomps_not_allowed_in_nonbase_partitionserror_graphics_vail_failed_to_send_create_superwetink_messageerror_graphics_vail_failed_to_send_destroy_superwetink_messageerror_graphics_vail_failed_to_send_composition_window_dpi_messageerror_graphics_empty_adapter_monitor_mode_support_intersectionerror_graphics_monitor_could_not_be_associated_with_adaptererror_graphics_invalid_path_content_geometry_transformations[1herror_graphics_path_content_geometry_transformation_not_supportederror_graphics_invalid_vidpn_topology_recommendation_reason.wvuerror_graphics_path_content_geometry_transformation_not_pinnederror_graphics_invalid_monitor_frequencyrange_constrainterror_graphics_opm_video_output_does_not_have_copp_semanticserror_graphics_opm_video_output_does_not_have_opm_semanticserror_graphics_ddcci_monitor_returned_invalid_timing_status_byteerror_graphics_ddcci_current_current_value_greater_than_maximum_valuefve_e_protector_change_max_passphrase_change_attempts_reachedliedfve_e_passphrase_protector_change_by_std_user_disallowedvm_saved_state_dump_e_nested_virtualization_not_supportederror_volmgr_disk_layout_non_basic_between_basic_partitionserror_volmgr_disk_layout_primary_between_logical_partitionsd3d11_error_deferred_context_map_without_initial_discardeas_e_password_policy_not_enforceable_for_connected_admins" - Source: "00000000-00004856.00000001.237788.CD770000.00000004.mdmp") Found URL "https://pyrogram.org" - Source: "00000000-00004856.00000001.237788.CD770000.00000004.mdmp") Found URL "https://pyrogram.orggctl.text$mn.text$mn$00.text$x.idata$5.00cfg.crt$xca.crt$xcz.crt$xia.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.xdata.edata.idata$2.idata$3.idata$4.idata$6.data.bss.pdata.rsrc$01.rsrc$02tgcrypto.cp314-win_amd64.pydpyinit_tgcryptopyeval_savethreadpy_buildvaluepyerr_setstringpyexc_valueerrorpymodule_create2pybuffer_releasepyarg_parsetuplepyeval_restorethreadpython314.dllqueryperformancecountergetcurrentprocessidgetcurrentthreadidgetsystemtimeasfiletimedisablethreadlibrarycallsinitializeslistheadkernel32.dll__c_specific_handler__std_type_info_destroy_listvcruntime140.dllmallocfree_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-heap-l1-1-0.dllapi-ms-win-crt-runtime-l1-1-0.dllmemcpy" - Source: "00000000-00004856.00000001.237788.E6256000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00004856.00000001.237788.E62DE000.00000002.mdmp") Found URL "http://.decrypter\" (Indicator: \".decrypt\"; Source: \"00000000-00004856.00000000.237440.C9910000.00000004.mdmp, 00000000-00004856.00000001.237788.C9910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to decrypt/decode data\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004856.00000000.237440.99AEE000.00000002.mdmp, 00000000-00004856.00000001.237788.ECF54000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004856-00000C2B-2704745758\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004856-00000C2B-2704745758\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00004856-00000C2B-2708214752\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004856.00000000.237440.99AEE000.00000002.mdmp, 00000000-00004856.00000001.237788.E61F3000.00000002.mdmp, 00000000-00004856.00000001.237788.ECF54000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004856.00000000.237440.99AEE000.00000002.mdmp, 00000000-00004856.00000001.237788.ECF54000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004856-00000C2B-2705368263\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004856-00000C2B-2705431085\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00004856-00000C2B-2708214084\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"ba2085d015f02bc9ab296266b8b44ceb3449842aba44b393e4a00bfe3da5508f.bin\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00004856.00000000.237440.99AEE000.00000002.mdmp, 00000000-00004856.00000001.237788.E61F3000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004856.00000000.237440.99AEE000.00000002.mdmp, 00000000-00004856.00000001.237788.E61F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a4af4544613bf5fb60bc94d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"