34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 69:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Vidar Sample 326936b32576… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 326936b32576…. Malware family: Trojan.Vidar. Threat score 100/100. 13/25 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","keywords":["Malicious","Trojan.Vidar","malware analysis","sandbox report","threat intelligence","326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39"],"about":{"@type":"SoftwareApplication","name":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin","applicationCategory":["pedll","64bits","executable"],"identifier":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Vidar","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4bc,file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CopySid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "RevertToSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetLengthSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsValidSid"; Source: "sample.bin")37:T418,"adlock!trace: non-empty full trace buffer for done generationtrace: non-empty full trace buffer for next generation goroutine running on other thread; stack unavailable SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesruntime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusreflect: reflect.Value.Elem on an invalid notinheap pointermanual span a" in Source: sample.bin38:T3532,Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersService ttmq index: Cabin mzmg percent: Cabin okac percent: Service bqtd index: Cabin tlmu percent: Requests ekzdjirtu: Service pxou index: Requests teqxeoewd: Requests mevzbuhbd: invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (tes" (Indicator: "CertOpenSystemStoreW"; Source: "sample.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersService ttmq index: Cabin mzmg percent: Cabin okac percent: Service bqtd index: Cabin tlmu percent: Requests ekzdjirtu: Service pxou index: Requests teqxeoewd: Requests mevzbuhbd: invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (tes" (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0 the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethod", missing CPU support GetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: Unserved cabin targets: Requests xkajywxrbklna: Service ftsecysd index: Cabin amyvcfgv percent: maintain current regimenconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard Ti" (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found api reference " of rangereflect: Len of non-array type Requests viffqalzabemiqtupeyfw: Requests fsffackoyridlnwkqvwqt: Service dctxdovobpxnbwtk index: Service kkuvtnzdqsdtnbpo index: Requests iwccgwukxnoogyzzryowr: conditions optimal, monitor onlyCabin waoclmdlcxeoscht percent: Service lsrquvkizabapurz index: resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "sample.bin"), Found api reference " of rangereflect: Len of non-array type Requests viffqalzabemiqtupeyfw: Requests fsffackoyridlnwkqvwqt: Service dctxdovobpxnbwtk index: Service kkuvtnzdqsdtnbpo index: Requests iwccgwukxnoogyzzryowr: conditions optimal, monitor onlyCabin waoclmdlcxeoscht percent: Service lsrquvkizabapurz index: resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "sample.bin"), Found api reference "g hall calls queued: Requests bssdoryvfqyamwvm: Cabin hnqwpdkbrls percent: Requests nsuhmkqnpvtjrjdu: Service urxqxcfivsw index: Cabin rgnrexhuymh percent: Cabin uwqluoiybua percent: Requests xhmgrtvaoydwvlvc: Service zngubygqfod index: Cabin cpdzcgffcji percent: Requests memtrgsmsuwcyrla: Cabin miuonnpgjsw percent: channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625Easter Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; Source: "sample.bin"), Found api reference "abin imtlhmplyshh percent: Cabin jrxmkyulpddy percent: Cabin avyymdkujmwm percent: Lzbkapyczs: %.1f%% (%s) file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "GC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map e" (Indicator: "CertCreateCertificateContext"; Source: "sample.bin"), Found api reference "il stackbase} sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found api reference "il stackbase} sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "= invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preempt bad manualFreeListruntime: textAddr frames elided... , locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialPassengers served: Requests jzxupwen: bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Float14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard Tim" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2 system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain " (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limit runtime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekm) doors open level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failedn" (Indicator: "CertOpenStore"; Source: "sample.bin"), Found api reference "ableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandle1455191522836685180664062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryunknown ABI parameter kindRtlNtStatusToDosErrorNoTebPendin" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin")39:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1539962475 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1539983373 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1540331960 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1540356958 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1540708653 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1540863159 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1541622918 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1541755906 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1541915399 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1542034373 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1542056527 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1542157981 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1542181121 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00002036-00000C15-1542195552 [PID: 2036] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1539965442 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1539994782 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1540369192 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1540375879 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1540714385 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1540932451 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1542030817 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1542100681 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1542225901 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1542237311 [PID: 5040] "rundll32.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-1542272996 [PID: 5040]3a:Ta13,Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001672.00000000.166020.E45C0000.00000004.mdmp, 00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002036.00000000.162993.39190000.00000004.mdmp, 00000000-00002036.00000001.164139.39190000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002260.00000000.166362.E3F50000.00000004.mdmp, 00000000-00002260.00000001.167484.E3F50000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002344.00000000.162994.9C140000.00000004.mdmp, 00000000-00002344.00000001.164199.9C140000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003396.00000000.166402.C90D0000.00000004.mdmp, 00000000-00003396.00000001.167620.C90D0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003932.00000000.162994.12090000.00000004.mdmp, 00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004876.00000000.164475.3F730000.00000004.mdmp, 00000000-00004876.00000001.165698.3F730000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004908.00000000.164525.47320000.00000004.mdmp, 00000000-00004908.00000001.165694.47320000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005040.00000000.162993.21750000.00000004.mdmp, 00000000-00005040.00000001.164149.21750000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005304.00000000.167208.029F0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006000.00000000.166018.D3AE0000.00000004.mdmp, 00000000-00006000.00000001.166886.D3AE0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007120.00000000.164922.31FA0000.00000004.mdmp, 00000000-00007120.00000001.166038.31FA0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007316.00000000.164463.580A0000.00000004.mdmp, 00000000-00007316.00000001.166068.580A0000.00000004.mdmp")3b:Tb37,Found XOR loop in file "sample.bin" at offset 91794; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1819160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2618366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2623742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2804990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2998755; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3003153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3017145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3508795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2163514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2389853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2495985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2792433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2969830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3571908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 188406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 251569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 271696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 415454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1756632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2579188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3065734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3130273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3172934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3349129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3699776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3737512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3820680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4161686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4164962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4177904; code bytes = 80303c:T75c,Found string "WDAGUtilityAccount" (Source: "00000000-00001672.00000000.166020.E45C0000.00000004.mdmp, 00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00002036.00000000.162993.39190000.00000004.mdmp, 00000000-00002036.00000001.164139.39190000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00002260.00000000.166362.E3F50000.00000004.mdmp, 00000000-00002260.00000001.167484.E3F50000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00002344.00000001.164199.9C140000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00003396.00000000.166402.C90D0000.00000004.mdmp, 00000000-00003396.00000001.167620.C90D0000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00003932.00000000.162994.12090000.00000004.mdmp, 00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00004876.00000000.164475.3F730000.00000004.mdmp, 00000000-00004876.00000001.165698.3F730000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00004908.00000000.164525.47320000.00000004.mdmp, 00000000-00004908.00000001.165694.47320000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00005040.00000000.162993.21750000.00000004.mdmp, 00000000-00005040.00000001.164149.21750000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00006000.00000000.166018.D3AE0000.00000004.mdmp, 00000000-00006000.00000001.166886.D3AE0000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00007120.00000000.164922.31FA0000.00000004.mdmp, 00000000-00007120.00000001.166038.31FA0000.00000004.mdmp") Found string "WDAGUtilityAccount" (Source: "00000000-00007316.00000000.164463.580A0000.00000004.mdmp, 00000000-00007316.00000001.166068.580A0000.00000004.mdmp")3d:T277e,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002036) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002036) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002344) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002344) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003932) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003932) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003932) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007316) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007316) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007316) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004876) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004876) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004908) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004908)3e:T4f7,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3f:T1cbd,"rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002036) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005040) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002344) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003932) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007316) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004876) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004908) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007120) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001672) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002260) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003396) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005304) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005304) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005304) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005304) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005304)40:T712,"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpAllocMemory" at ordinal 1 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpClientUtilExportFunctions" at ordinal 2 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigClose" at ordinal 3 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigGetValue" at ordinal 4 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigGetValueAlloc" at ordinal 5 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigInitialize" at ordinal 6 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigOpen" at ordinal 7 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigRegisterForNotifications" at ordinal 8 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigSetValue" at ordinal 9 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigUninitialize" at ordinal 10 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpConfigUnregisterNotifications" at ordinal 11 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "MpFreeMemory" at ordinal 12 "326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin" contains export function called "_cgo_dummy_export" at ordinal 1341:T7a0,Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#1" (UID: 00000000-00002036) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#4" (UID: 00000000-00005040) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#3" (UID: 00000000-00002344) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#2" (UID: 00000000-00003932) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#5" (UID: 00000000-00007316) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#6" (UID: 00000000-00004876) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#7" (UID: 00000000-00004908) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#8" (UID: 00000000-00007120) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#9" (UID: 00000000-00006000) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#10" (UID: 00000000-00001672) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#11" (UID: 00000000-00002260) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#12" (UID: 00000000-00003396) Process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll",#13" (UID: 00000000-00005304)42:T674,Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "user-agent: "; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "user-agent: "; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp")43:T8cb8,"GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Set-Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378; expires=Sat 15 Aug 2026 16:36:46 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:36:47 GMT Content-Length: 6448 Connection: keep-alive Set-Cookie: sessionid=0712343dc5ded38b30aa1d8c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=None with response body ==>0A3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E222020....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:36:52 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:36:56 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:37:00 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:37:04 GMT Content-Length: 6448 Connection: keep-alive with response body ==>0A3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E222020....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3659 Connection: keep-alive Set-Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773; expires=Sat 15 Aug 2026 16:37:12 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 6447 Date: Fri 14 Aug 2026 16:37:12 GMT Connection: keep-alive Set-Cookie: sessionid=14c9a64e04d1da3dc1a831e6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=None with response body ==>0A3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E222020....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3658 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5833 Date: Fri 14 Aug 2026 16:37:16 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3659 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:37:21 GMT Content-Length: 5831 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5832 Date: Fri 14 Aug 2026 16:37:25 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Set-Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628; expires=Sat 15 Aug 2026 16:37:34 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......44:T6cd,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffef3f30000 "rundll32.exe" loaded module "C:\326936B32576E55384CA2034D68EF83BE41341A9979FD2CC0054E76396FF7A39.BIN.DLL" at base 7ffeedcf0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff10e90000 "rundll32.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7fff12aa0000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7fff16500000 "rundll32.exe" loaded module "WINMM.DLL" at base 7fff0ac20000 "rundll32.exe" loaded module "POWRPROF.DLL" at base 7fff128b0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7fff13b70000 "rundll32.exe" loaded module "BCRYPT.DLL" at base 7fff12350000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff12aa0000 "rundll32.exe" loaded module "WINHTTP.DLL" at base 7fff0f0b0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffef4860000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7fff16040000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff12080000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 7fff12750000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff11bd0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff0b250000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff0b8e0000 "rundll32.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff04370000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff043c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff11c90000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7fff13b7000045:T6ca,Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00005040), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00002344) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00003932), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00007316) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00004876), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00004908) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00007120), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00006000) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00001672), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00002260) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00003396), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00005304)46:T6ca,Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00005040), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00002344) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00003932), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00007316) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00004876), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00004908) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00007120), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00006000) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00001672), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00002260) Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00003396), Spawned process "rundll32.exe" with commandline ""C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396f ..." (UID: 00000000-00005304)47:T661,The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 22:1C:06:25:34:4E:BF:DF:61:A5:AF:8D:C2:0E:ED:74:32:6B:F8:FB; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=easports.gg, O=gkkKJqPpbY0, L=PIOeenoI3, ST=57acTg3n, C=US" (SHA1: 8B:82:CB:9E:B1:95:32:6D:93:05:CA:43:81:59:80:26:82:45:04:83; see report for more information)48:T66a,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")49:Tef7,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SEARCHPATHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")4a:T1d53,"rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229120cebd0" "dwHeadersLength": "0" "lpOptional": "------dddbab1334def88a2507Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------dddbab1334def88a2507Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------dddbab1334def88a2507" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2f8f"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------c9dd5bcba6649808da89Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------c9dd5bcba6649808da89Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------c9dd5bcba6649808da89" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------d0347aa6b6163d472e69Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------d0347aa6b6163d472e69Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------d0347aa6b6163d472e69" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22959a19810" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22912106d30" "dwHeadersLength": "0" "lpOptional": "------1977dd8b6589eac4fa82Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------1977dd8b6589eac4fa82Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------1977dd8b6589eac4fa82" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22959a13d00" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22959a30f00" "dwHeadersLength": "0" "lpOptional": "------bdd5b709c20b90407989Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------bdd5b709c20b90407989Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------bdd5b709c20b90407989" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22959a13d00" "dwHeadersLength": "0" "lpOptional": "------76c6211d65881fd9bd99Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------76c6211d65881fd9bd99Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------76c6211d65881fd9bd99" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2f8f"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22912107300" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------00c48718cf50bb4505b0Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------00c48718cf50bb4505b0Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------00c48718cf50bb4505b0" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2f8f"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22912107300" "dwHeadersLength": "0" "lpOptional": "------00c48718cf50bb4505b0Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------00c48718cf50bb4505b0Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------00c48718cf50bb4505b0" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------9e35ef8c820841f2a94dContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9e35ef8c820841f2a94dContent-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------9e35ef8c820841f2a94d" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------a8e130e0f58f94bdcf00Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a8e130e0f58f94bdcf00Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------a8e130e0f58f94bdcf00" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2f8f"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------9ec02f8c16fdaa567661Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9ec02f8c16fdaa567661Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------9ec02f8c16fdaa567661" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------a88a1dd6be37124185eeContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a88a1dd6be37124185eeContent-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------a88a1dd6be37124185ee" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------861b2dd1921419b163ccContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------861b2dd1921419b163ccContent-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------861b2dd1921419b163cc" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2f8f"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------a0b61661e891e15c1e24Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a0b61661e891e15c1e24Content-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------a0b61661e891e15c1e24" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "229121137e0" "dwHeadersLength": "0" "lpOptional": "------4a7d8c11765483d37a6bContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------4a7d8c11765483d37a6bContent-Disposition: form-data; name=\"build_id\"19a94d8683f43bedcfc642201ccf482a------4a7d8c11765483d37a6b" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0" "$error": "2ee7"}4b:T532,"rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "229121137e0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22959a19810" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22912106d30" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22959a13d00" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22959a30f00" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22912107300" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e581249e0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e58126040" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e58124850" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e7f9790e0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e580cf0d0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16e5811c1d0" "lpReserved": "0"}4c:T47a8,Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c9dd5bcba6649808da89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=c70118c266cdb14987_8424436046561293378------c9dd5bcba6649808da89Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------c9dd5bcba6649808da89Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------c9dd5bcba6649808da89Content-Disposition: form-data; name="format"json------c9dd5bcba6649808da89--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----1977dd8b6589eac4fa82Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=c70118c266cdb14987_8424436046561293378------1977dd8b6589eac4fa82Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------1977dd8b6589eac4fa82Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------1977dd8b6589eac4fa82Content-Disposition: form-data; name="format"json------1977dd8b6589eac4fa82--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bdd5b709c20b90407989Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c------bdd5b709c20b90407989Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------bdd5b709c20b90407989Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------bdd5b709c20b90407989Content-Disposition: form-data; name="format"json------bdd5b709c20b90407989--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----00c48718cf50bb4505b0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=c70118c266cdb14987_8424436046561293378------00c48718cf50bb4505b0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------00c48718cf50bb4505b0Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------00c48718cf50bb4505b0Content-Disposition: form-data; name="format"json------00c48718cf50bb4505b0--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9e35ef8c820841f2a94dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c------9e35ef8c820841f2a94dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9e35ef8c820841f2a94dContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9e35ef8c820841f2a94dContent-Disposition: form-data; name="format"json------9e35ef8c820841f2a94d--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ec02f8c16fdaa567661Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=c70118c266cdb14987_8424436046561293378------9ec02f8c16fdaa567661Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9ec02f8c16fdaa567661Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9ec02f8c16fdaa567661Content-Disposition: form-data; name="format"json------9ec02f8c16fdaa567661--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a88a1dd6be37124185eeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c------a88a1dd6be37124185eeContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a88a1dd6be37124185eeContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a88a1dd6be37124185eeContent-Disposition: form-data; name="format"json------a88a1dd6be37124185ee--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a0b61661e891e15c1e24Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=c70118c266cdb14987_8424436046561293378------a0b61661e891e15c1e24Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a0b61661e891e15c1e24Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a0b61661e891e15c1e24Content-Disposition: form-data; name="format"json------a0b61661e891e15c1e24--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4098bef979e8a91cba6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=ade55285e156e9478f_17281533630041149773------b4098bef979e8a91cba6Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------b4098bef979e8a91cba6Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------b4098bef979e8a91cba6Content-Disposition: form-data; name="format"json------b4098bef979e8a91cba6--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----2001743969c8274e9eb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=ade55285e156e9478f_17281533630041149773------2001743969c8274e9eb4Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------2001743969c8274e9eb4Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------2001743969c8274e9eb4Content-Disposition: form-data; name="format"json------2001743969c8274e9eb4--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----92b674e7da695ea23502Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6------92b674e7da695ea23502Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------92b674e7da695ea23502Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------92b674e7da695ea23502Content-Disposition: form-data; name="format"json------92b674e7da695ea23502--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----53e2b675091968bf0729Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=ade55285e156e9478f_17281533630041149773------53e2b675091968bf0729Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------53e2b675091968bf0729Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------53e2b675091968bf0729Content-Disposition: form-data; name="format"json------53e2b675091968bf0729--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ea2adf5cc0282a188a83Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6------ea2adf5cc0282a188a83Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------ea2adf5cc0282a188a83Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------ea2adf5cc0282a188a83Content-Disposition: form-data; name="format"json------ea2adf5cc0282a188a83--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----e85693123ffa0fb6f061Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=ade55285e156e9478f_17281533630041149773------e85693123ffa0fb6f061Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------e85693123ffa0fb6f061Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------e85693123ffa0fb6f061Content-Disposition: form-data; name="format"json------e85693123ffa0fb6f061--"; File: "PCAP") Found string "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----863f794718025fdb79e1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6------863f794718025fdb79e1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------863f794718025fdb79e1Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------863f794718025fdb79e1Content-Disposition: form-data; name="format"json------863f794718025fdb79e1--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0625b73067bf7e82a896Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628------0625b73067bf7e82a896Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0625b73067bf7e82a896Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0625b73067bf7e82a896Content-Disposition: form-data; name="format"json------0625b73067bf7e82a896--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----6e6915580d1ed5d3be5bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="format"json------6e6915580d1ed5d3be5b--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----377e7ac3ee8fb8d084dcAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="format"json------377e7ac3ee8fb8d084dc--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0a86ac70b78d636973d7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628------0a86ac70b78d636973d7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0a86ac70b78d636973d7Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0a86ac70b78d636973d7Content-Disposition: form-data; name="format"json------0a86ac70b78d636973d7--"; File: "PCAP") Found string "POST /gk6p2s HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----fb6272f38c015a4015d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: t.meCookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628------fb6272f38c015a4015d3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------fb6272f38c015a4015d3Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------fb6272f38c015a4015d3Content-Disposition: form-data; name="format"json------fb6272f38c015a4015d3--"; File: "PCAP") Found string "------dddbab1334def88a2507Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------dddbab1334def88a2507Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------dddbab1334def88a2507"; Source: "00000000-00003932-00000CCC-1548093788") Found string "------c9dd5bcba6649808da89Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------c9dd5bcba6649808da89Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------c9dd5bcba6649808da89"; Source: "00000000-00003932-00000CCC-1549431637") Found string "------d0347aa6b6163d472e69Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------d0347aa6b6163d472e69Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------d0347aa6b6163d472e69"; Source: "00000000-00003932-00000CCC-1549940486") Found string "------1977dd8b6589eac4fa82Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------1977dd8b6589eac4fa82Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------1977dd8b6589eac4fa82"; Source: "00000000-00003932-00000CCC-1554724215") Found string "------bdd5b709c20b90407989Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------bdd5b709c20b90407989Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------bdd5b709c20b90407989"; Source: "00000000-00003932-00000CCC-1555087664")4d:Td7e,Potential IP "37.27.204.215" found in string "07s [*] Direct: https://37.27.204.215" "37.27.204.215" Potential IP "37.27.204.215" found in string "10s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "16s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "20s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "24s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "27s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "29s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "32s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "36s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "39s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "43s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "47s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "52s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "55s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "58s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:00 [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:04 [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:07 [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:10 [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:13 [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "31s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "35s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "38s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "41s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "45s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "48s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "51s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "54s [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "58s [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:02 [!] Connect failed: https://37.27.204.215" Potential IP "37.27.204.215" found in string "1:05 [*] Direct: https://37.27.204.215" Potential IP "37.27.204.215" found in string "ttps://37.27.204.215:443/" Potential IP "37.27.204.215" found in string "https://37.27.204.215/" "7.27.204.215" Potential IP "37.27.204.215" found in string "ttps://37.27.204.215/" Potential IP "37.27.204.215" found in string "37.27.204.215/" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.14" "2.5.29.19" "2.5.29.32" "2.5.29.15" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" Potential IPs "127.0.0.1" "127.0.0.1" found in string "maized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-sr"4e:Tf16d,Found URL "https://t.me/gk6p2sl\pr" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://37.27.204.215/https://t.me/gk6p2ssteamcommunity.comhttps://37.27.204.215/nformat" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759https://steamcommunity.com/profiles/76561198667588759ectigo" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://t.me/gk6p2sdead" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;postno-cache.1.5https://@cache-controlno-cachehttps://cache-cache" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://%scontent-content-lengthhttps://@connecti" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://37.27.204.215/pragmame/gk6p2scache-controlno-cacheconnecticonnecticontent-connectionkeep-alivepost-controlno-cachehttps://t.me/gk6p2sconnectionkeep-alivedead" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]w[)fj" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://37.27.204.215/sourceficonnectihttps://37.27.204.215/mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759scrd1.3.6.1.5.5.7.3.1hrbtscrdhrbt88759q*iq=3bv:tbz69%ory08>=i@iqoz" - Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found URL "https://vog.peluangsm188.top/https://steamcommunity.com/profiles/76561198667588759profiles/76561198667588759profiles/76561198667588759profiles/76561198667588759steamcommunity.comsteamcommunity.comsteamcommunity.comsteamcommunity.commicrosoft" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/765611986675887594.215170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-security-policy:" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-encoding:" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://web.telegram.orgx-frame-optionsallow-from" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://web.telegram.orgpersistent-authwww-authenticatevaryset-cookienginx/1.30.1serverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedexpirescontent-rangecontent-md5content-locationcontent-languagecontent-encodingtext/html;" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/;x-frame-optionssameoriginpersistent-authwww-authenticateaccept-encodingvaryset-cookienginxserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedmon," - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yzgck0nu7kh&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=0ihq-paoptbq&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=lpzp0xcbpqos&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/globalv2.css?v=vjjj6r-t5gm6&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=ofuqlcdnid6y&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=g6us9kbt7364&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=em4kcu67dnda&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npjelbnreo6w&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdakocdigbc&l=english&_cdn=fastly&load=effects,controls,slider,dragdrop" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/global.js?v=to0fap8kd8yj&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=a9q1reojmdbo&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=lkhhgyvattqm&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6qbwi-5-j2s&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=asnznxt9kvqn&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/login/home/?goto=profiles%2f76561198667588759" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/explore/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/wishlist/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/points/shop/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/news/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/stats/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/discussions/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/workshop/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/market/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com/?subsection=broadcasts" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/about/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://help.steampowered.com/en/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/mobile" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/footerlogo_valve_new.png" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/privacy_agreement/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "http://www.valvesoftware.com/legal.htm" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/steam_refunds/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://www.valvesoftware.com/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=e-2chqehetzt&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=4yvxp8h4zprf&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=m-gv2wver3gk&l=english&_cdn=fastly" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://steamcommunity.com" - Source: "00000000-00001672.00000001.167626.EBED0000.00000004.mdmp") Found URL "https://t.me/gk6p2sta\oracle\java\javapath;indows\system32;c:\windo:\windows\system32\wbem;indows\system32\windowsphshell\v1.0\;%nvm_home%;%symlink%;c:\users\hapubwpdata\local\programs\pyters\!" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://37.27.204.215/https://t.me/gk6p2shttps://37.27.204.215/steamcommunity.com4.21588.topttps://vog.peluangsm188.top:443/?community.com:443/profiles/76561198667588759ttps://37.27.204.215:443/443/profiles/76561198667588759icrosoft" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759dc8d9d6tt.met.mettps://t.me/teamcommunity.comttps://t.me/ttps://t.me/7.27.204.215ttps://t.me/ttps://t.me/7.27.204.215ttps://t.me/ttps://t.me/ttps://t.me/:\sp7.27.204.2157.27.204.2157.27.204.2157.27.204.215teamcommunity.com7.27.204.2157.27.204.215oftware\policies\microsoft\systemcertificates\trustoftware\policies\microsoft\systemcertificates\trusticrosoft" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.youtube-nocookie.ct" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://t.me/gk6p2s*hh*dead" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://store.steampowered.com/;x-frame-optionssameoriginpersistent-authwww-authenticateaccept-encodingvaryset-cookienginxserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedmon," - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://web.telegram.orgx-frame-optionsallow-from" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://web.telegram.orgpersistent-authwww-authenticatevaryset-cookienginx/1.30.1serverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedexpirescontent-rangecontent-md5content-locationcontent-languagecontent-encodingtext/html;" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://%scache-controlno-cache)cf-?https://37.27.204.215/https://37.27.204.215/connectionkeep-alivepragmano-cacheconnectionkeep-alivecontent-lengthalivehttps://pragmano-cachepost37.27.204.215p-aliveconnecti0https://t.me/gk6p2scache-controlno-cacheconnectipragmano-cacheconnectippostcontent-lengthcache-coconnectionkeep-alivesteamcomconnecti00p1+0)" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erisroot" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://bdddaccept-languageen-us,en;q=0.9c2" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhuriiy.com+'nzte3e(zus1" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://t.meglobalsign" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759https://steamcommunity.com/profiles/76561198667588759https://steamcommunity.com/profiles/76561198667588759w1,t51nte0>u+0@u" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/explore/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/wishlist/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/points/shop/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/news/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/stats/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/discussions/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/workshop/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/market/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/?subsection=broadcasts" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://store.steampowered.com/about/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://help.steampowered.com/en/" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://steamcommunity.com/login/home/?goto=profiles%2f76561198667588759" - Source: "00000000-00003932.00000001.164597.599F0000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://telegram.org/img/t_logo_2x.png" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yzgck0nu7kh&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=0ihq-paoptbq&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=lpzp0xcbpqos&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/globalv2.css?v=vjjj6r-t5gm6&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=jqr3vzxd_fz5&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=g6us9kbt7364&l=english&_cdn=fastly" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=em4kc" - Source: "00000000-00003932.00000001.164597.59A14000.00000004.mdmp") Found URL "https://37.27.204.215/ta\oracle\java\javapath;indows\system32;c:\windo:\windows\system32\wbem;" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://t.me/gk6p2shttps://37.27.204.215/teamcommunity.comhttps://37.27.204.215/https://t.me/gk6p2s=<5/steamcommunity.comsteamcommunity.comvog.peluangsm188.topvog.peluangsm188.topen-usmicrosoft" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759https://steamcommunity.com/profiles/76561198667588759ttps://t.me/ectigo" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://37.27.204.215/sb:" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://community.fastly.ss://ly.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://api.ste://r.net" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.gstatic.cn/re.gst/recaptcha/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://store.steampoweckopowered.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://aphttpn.steampowered.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://steammmun" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://*.dervetps://*.steamcontent.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://lv.queniujq.ccastmaized.net" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://login.ste://csteampowered.com/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.youtube-noww.gm" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://medal.t.comha/" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://t.me/gk6p2sconnect" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://t.me/gk6p2sconnectionkeep-alivepragmano-cacheemgrtimr0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://web.telegram.orgx-frame-optionsallow-from" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://web.telegram.orgpersistent-authwww-authenticatevaryset-cookienginx/1.30.1serverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedexpirescontent-rangecontent-md5content-locationcontent-languagecontent-encodingtext/html;" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ecgg" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erisroot" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://t.mezgs" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://37.27.204.215/connecti@dead" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://https://@content-lengthhttps://%s?bbm?isign," - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://37.27.204.215/https://" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://37.27.204.215/cache-cocontent-post=gc.?gz/connectionkeep-alive;gb1connecti" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://37.27.204.215/cth" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:?%'q%" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found URL "https://steamcommunity.com/inrules_autoupdate_1subcasubcaprofiles/76561198667588759profiles/76561198667588759teamcommunity.commicrosoft" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/765611986675887597588759hrbthrbthrbthrbthrbt7588759scrd1.3.6.1.5.5.7.3.1dead" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198667588759scrd758875989_oscrdscrdhrbtfw4=;q=0.8accepttext/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8bz693bv:t!1.3.6.1.4.1.311.10.3.33accepttext/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*ed.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://st-tednx.lv.q" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://ww.yle.c/recaptcha.net/recap=self'" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://st19y7" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://*.content-security-policydefault-src" - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://store.steampowered.com/;x-frame-optionssameoriginpersistent-authwww-authenticateaccept-encodingvaryset-cookienginxserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedmon," - Source: "00000000-00007316.00000001.166068.7F960000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://st06" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00007316.00000001.166068.7F97F000.00000004.mdmp")4f:Taf1,GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378 GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773 GET /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6 GET /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628 50:T12be,Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "GET /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bdd5b709c20b90407989Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9e35ef8c820841f2a94dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a88a1dd6be37124185eeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "GET /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----92b674e7da695ea23502Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ea2adf5cc0282a188a83Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "POST /profiles/76561198667588759 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----863f794718025fdb79e1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0Content-Length: 345Host: steamcommunity.comCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6"51:T616,Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00007316.00000001.166068.580A0000.00000004.mdmp")52:T646,"rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002036) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002036) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00005040) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00005040) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002344) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002344) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00003932) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00003932) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00007316) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00007316) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004876) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004876) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004908) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004908) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00007120) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00007120) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00006000) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00006000) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00001672) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00001672) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002260) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002260) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00003396) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00003396)53:T140f,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001672.00000000.166020.E45C0000.00000004.mdmp, 00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001672.00000000.166020.E45C0000.00000004.mdmp, 00000000-00001672.00000001.167626.E45C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002036.00000000.162993.39190000.00000004.mdmp, 00000000-00002036.00000001.164139.39190000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002036.00000000.162993.39190000.00000004.mdmp, 00000000-00002036.00000001.164139.39190000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002260.00000000.166362.E3F50000.00000004.mdmp, 00000000-00002260.00000001.167484.E3F50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002260.00000000.166362.E3F50000.00000004.mdmp, 00000000-00002260.00000001.167484.E3F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002344.00000000.162994.9C140000.00000004.mdmp, 00000000-00002344.00000001.164199.9C140000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002344.00000000.162994.9C140000.00000004.mdmp, 00000000-00002344.00000001.164199.9C140000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003396.00000000.166402.C90D0000.00000004.mdmp, 00000000-00003396.00000001.167620.C90D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003396.00000000.166402.C90D0000.00000004.mdmp, 00000000-00003396.00000001.167620.C90D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003932.00000000.162994.12090000.00000004.mdmp, 00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003932.00000000.162994.12090000.00000004.mdmp, 00000000-00003932.00000001.164597.12090000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004876.00000000.164475.3F730000.00000004.mdmp, 00000000-00004876.00000001.165698.3F730000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004876.00000000.164475.3F730000.00000004.mdmp, 00000000-00004876.00000001.165698.3F730000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004908.00000000.164525.47320000.00000004.mdmp, 00000000-00004908.00000001.165694.47320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004908.00000000.164525.47320000.00000004.mdmp, 00000000-00004908.00000001.165694.47320000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005040.00000000.162993.21750000.00000004.mdmp, 00000000-00005040.00000001.164149.21750000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00005040.00000000.162993.21750000.00000004.mdmp, 00000000-00005040.00000001.164149.21750000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005304.00000000.167208.029F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00005304.00000000.167208.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006000.00000000.166018.D3AE0000.00000004.mdmp, 00000000-00006000.00000001.166886.D3AE0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00006000.00000000.166018.D3AE0000.00000004.mdmp, 00000000-00006000.00000001.166886.D3AE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007120.00000000.164922.31FA0000.00000004.mdmp, 00000000-00007120.00000001.166038.31FA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00007120.00000000.164922.31FA0000.00000004.mdmp, 00000000-00007120.00000001.166038.31FA0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007316.00000000.164463.580A0000.00000004.mdmp, 00000000-00007316.00000001.166068.580A0000.00000004.mdmp")54:T9ce,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")55:T8e89,"POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c9dd5bcba6649808da89 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload::==> "------c9dd5bcba6649808da89Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------c9dd5bcba6649808da89Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------c9dd5bcba6649808da89Content-Disposition: form-data; name="format"json------c9dd5bcba6649808da89--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1977dd8b6589eac4fa82 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload::==> "------1977dd8b6589eac4fa82Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------1977dd8b6589eac4fa82Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------1977dd8b6589eac4fa82Content-Disposition: form-data; name="format"json------1977dd8b6589eac4fa82--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bdd5b709c20b90407989 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload::==> "------bdd5b709c20b90407989Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------bdd5b709c20b90407989Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------bdd5b709c20b90407989Content-Disposition: form-data; name="format"json------bdd5b709c20b90407989--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:36:52 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----00c48718cf50bb4505b0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload::==> "------00c48718cf50bb4505b0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------00c48718cf50bb4505b0Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------00c48718cf50bb4505b0Content-Disposition: form-data; name="format"json------00c48718cf50bb4505b0--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9e35ef8c820841f2a94d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload::==> "------9e35ef8c820841f2a94dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9e35ef8c820841f2a94dContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9e35ef8c820841f2a94dContent-Disposition: form-data; name="format"json------9e35ef8c820841f2a94d--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:36:56 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9ec02f8c16fdaa567661 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload::==> "------9ec02f8c16fdaa567661Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9ec02f8c16fdaa567661Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9ec02f8c16fdaa567661Content-Disposition: form-data; name="format"json------9ec02f8c16fdaa567661--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a88a1dd6be37124185ee Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload::==> "------a88a1dd6be37124185eeContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a88a1dd6be37124185eeContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a88a1dd6be37124185eeContent-Disposition: form-data; name="format"json------a88a1dd6be37124185ee--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Fri 14 Aug 2026 16:37:00 GMT Content-Length: 5832 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a0b61661e891e15c1e24 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload::==> "------a0b61661e891e15c1e24Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a0b61661e891e15c1e24Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a0b61661e891e15c1e24Content-Disposition: form-data; name="format"json------a0b61661e891e15c1e24--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----b4098bef979e8a91cba6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload::==> "------b4098bef979e8a91cba6Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------b4098bef979e8a91cba6Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------b4098bef979e8a91cba6Content-Disposition: form-data; name="format"json------b4098bef979e8a91cba6--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----2001743969c8274e9eb4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload::==> "------2001743969c8274e9eb4Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------2001743969c8274e9eb4Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------2001743969c8274e9eb4Content-Disposition: form-data; name="format"json------2001743969c8274e9eb4--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----92b674e7da695ea23502 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload::==> "------92b674e7da695ea23502Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------92b674e7da695ea23502Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------92b674e7da695ea23502Content-Disposition: form-data; name="format"json------92b674e7da695ea23502--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5833 Date: Fri 14 Aug 2026 16:37:16 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----53e2b675091968bf0729 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload::==> "------53e2b675091968bf0729Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------53e2b675091968bf0729Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------53e2b675091968bf0729Content-Disposition: form-data; name="format"json------53e2b675091968bf0729--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ea2adf5cc0282a188a83 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload::==> "------ea2adf5cc0282a188a83Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------ea2adf5cc0282a188a83Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------ea2adf5cc0282a188a83Content-Disposition: form-data; name="format"json------ea2adf5cc0282a188a83--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5831 Date: Fri 14 Aug 2026 16:37:21 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----e85693123ffa0fb6f061 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload::==> "------e85693123ffa0fb6f061Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------e85693123ffa0fb6f061Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------e85693123ffa0fb6f061Content-Disposition: form-data; name="format"json------e85693123ffa0fb6f061--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----863f794718025fdb79e1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload::==> "------863f794718025fdb79e1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------863f794718025fdb79e1Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------863f794718025fdb79e1Content-Disposition: form-data; name="format"json------863f794718025fdb79e1--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5832 Date: Fri 14 Aug 2026 16:37:25 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0625b73067bf7e82a896 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload::==> "------0625b73067bf7e82a896Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0625b73067bf7e82a896Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0625b73067bf7e82a896Content-Disposition: form-data; name="format"json------0625b73067bf7e82a896--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----6e6915580d1ed5d3be5b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload::==> "------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="format"json------6e6915580d1ed5d3be5b--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----377e7ac3ee8fb8d084dc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload::==> "------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="format"json------377e7ac3ee8fb8d084dc--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0a86ac70b78d636973d7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload::==> "------0a86ac70b78d636973d7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0a86ac70b78d636973d7Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0a86ac70b78d636973d7Content-Disposition: form-data; name="format"json------0a86ac70b78d636973d7--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----fb6272f38c015a4015d3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload::==> "------fb6272f38c015a4015d3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------fb6272f38c015a4015d3Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------fb6272f38c015a4015d3Content-Disposition: form-data; name="format"json------fb6272f38c015a4015d3--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Fri 14 Aug 2026 16:37:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......56:Tb96,"rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)57:T5aa,YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004876" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00006000" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00007316" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00001672" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00003932" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00005040" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00003396" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002260" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004908" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002344" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00007120" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002036"58:T18fd,"HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:46 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:51 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:51 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:55 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:55 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:36:59 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:00 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:12 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:16 GMTContent-Type: text/html; charset=utf-8Content-Length: 3658Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:16 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 3659Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:42 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:42 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:46 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 3660Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Fri, 14 Aug 2026 16:37:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 3661Connection: keep-alivePragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgC" (Indicator: "telegram.org") ".skype.com1&0" (Indicator: "skype.com") "community-stage.skype.com1" (Indicator: "skype.com")59:Tb2f,"rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")5a:T41db,"POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c9dd5bcba6649808da89 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload:==> "------c9dd5bcba6649808da89Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------c9dd5bcba6649808da89Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------c9dd5bcba6649808da89Content-Disposition: form-data; name="format"json------c9dd5bcba6649808da89--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1977dd8b6589eac4fa82 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload:==> "------1977dd8b6589eac4fa82Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------1977dd8b6589eac4fa82Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------1977dd8b6589eac4fa82Content-Disposition: form-data; name="format"json------1977dd8b6589eac4fa82--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bdd5b709c20b90407989 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload:==> "------bdd5b709c20b90407989Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------bdd5b709c20b90407989Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------bdd5b709c20b90407989Content-Disposition: form-data; name="format"json------bdd5b709c20b90407989--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----00c48718cf50bb4505b0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload:==> "------00c48718cf50bb4505b0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------00c48718cf50bb4505b0Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------00c48718cf50bb4505b0Content-Disposition: form-data; name="format"json------00c48718cf50bb4505b0--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9e35ef8c820841f2a94d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload:==> "------9e35ef8c820841f2a94dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9e35ef8c820841f2a94dContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9e35ef8c820841f2a94dContent-Disposition: form-data; name="format"json------9e35ef8c820841f2a94d--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9ec02f8c16fdaa567661 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload:==> "------9ec02f8c16fdaa567661Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------9ec02f8c16fdaa567661Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------9ec02f8c16fdaa567661Content-Disposition: form-data; name="format"json------9ec02f8c16fdaa567661--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a88a1dd6be37124185ee Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0712343dc5ded38b30aa1d8c" with payload:==> "------a88a1dd6be37124185eeContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a88a1dd6be37124185eeContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a88a1dd6be37124185eeContent-Disposition: form-data; name="format"json------a88a1dd6be37124185ee--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a0b61661e891e15c1e24 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=c70118c266cdb14987_8424436046561293378" with payload:==> "------a0b61661e891e15c1e24Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------a0b61661e891e15c1e24Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------a0b61661e891e15c1e24Content-Disposition: form-data; name="format"json------a0b61661e891e15c1e24--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----b4098bef979e8a91cba6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload:==> "------b4098bef979e8a91cba6Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------b4098bef979e8a91cba6Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------b4098bef979e8a91cba6Content-Disposition: form-data; name="format"json------b4098bef979e8a91cba6--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----2001743969c8274e9eb4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload:==> "------2001743969c8274e9eb4Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------2001743969c8274e9eb4Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------2001743969c8274e9eb4Content-Disposition: form-data; name="format"json------2001743969c8274e9eb4--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----92b674e7da695ea23502 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload:==> "------92b674e7da695ea23502Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------92b674e7da695ea23502Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------92b674e7da695ea23502Content-Disposition: form-data; name="format"json------92b674e7da695ea23502--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----53e2b675091968bf0729 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload:==> "------53e2b675091968bf0729Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------53e2b675091968bf0729Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------53e2b675091968bf0729Content-Disposition: form-data; name="format"json------53e2b675091968bf0729--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ea2adf5cc0282a188a83 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload:==> "------ea2adf5cc0282a188a83Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------ea2adf5cc0282a188a83Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------ea2adf5cc0282a188a83Content-Disposition: form-data; name="format"json------ea2adf5cc0282a188a83--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----e85693123ffa0fb6f061 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=ade55285e156e9478f_17281533630041149773" with payload:==> "------e85693123ffa0fb6f061Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------e85693123ffa0fb6f061Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------e85693123ffa0fb6f061Content-Disposition: form-data; name="format"json------e85693123ffa0fb6f061--" "POST /profiles/76561198667588759 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----863f794718025fdb79e1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=14c9a64e04d1da3dc1a831e6" with payload:==> "------863f794718025fdb79e1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------863f794718025fdb79e1Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------863f794718025fdb79e1Content-Disposition: form-data; name="format"json------863f794718025fdb79e1--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0625b73067bf7e82a896 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload:==> "------0625b73067bf7e82a896Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0625b73067bf7e82a896Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0625b73067bf7e82a896Content-Disposition: form-data; name="format"json------0625b73067bf7e82a896--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----6e6915580d1ed5d3be5b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload:==> "------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------6e6915580d1ed5d3be5bContent-Disposition: form-data; name="format"json------6e6915580d1ed5d3be5b--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----377e7ac3ee8fb8d084dc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload:==> "------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------377e7ac3ee8fb8d084dcContent-Disposition: form-data; name="format"json------377e7ac3ee8fb8d084dc--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0a86ac70b78d636973d7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload:==> "------0a86ac70b78d636973d7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------0a86ac70b78d636973d7Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------0a86ac70b78d636973d7Content-Disposition: form-data; name="format"json------0a86ac70b78d636973d7--" "POST /gk6p2s HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----fb6272f38c015a4015d3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0 Content-Length: 345 Host: t.me Cookie: stel_ssid=56435f3c4c45b8c5aa_11842381352090570628" with payload:==> "------fb6272f38c015a4015d3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-8244CE4------fb6272f38c015a4015d3Content-Disposition: form-data; name="build_id"19a94d8683f43bedcfc642201ccf482a------fb6272f38c015a4015d3Content-Disposition: form-data; name="format"json------fb6272f38c015a4015d3--"5b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC60:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC61:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC62:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC63:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC64:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC65:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC66:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC67:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC68:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794681225706,"unified_at":"2026-11-14T18:33:45.706Z","metadata":{"hashes":{"sha256":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","sha1":"d6227cf7319cd070b9f9d7a00884e54d8d068762","md5":"9d3a1b81c96c9093c4147eb210ebef35","sha512":"9cc65724af3f7c131056d4e02dc6a7e6dfbd74c6e976a37f60ac44a7e175c41a981683d1b6ecf7a08a39442b6aac4c63422ec6c98f0fd292e71f9770624ec12d","ssdeep":"49152:TmbfQhr0HcipdKvjLYypFdjth8C/G1bw0iNJOEYn1j75AHEw8uwWqk/2lhX:TVznfj1nT/G1lHEYn1j75AH1F5MX","ssdeep_chunks":["49152:TmbfQhr","49152:mbfQhr0","49152:bfQhr0H","49152:fQhr0Hc","49152:Qhr0Hci","49152:hr0Hcip","49152:r0Hcipd","49152:0HcipdK","49152:HcipdKv","49152:cipdKvj","49152:ipdKvjL","49152:pdKvjLY","49152:dKvjLYy","49152:KvjLYyp","49152:vjLYypF","49152:jLYypFd","49152:LYypFdj","49152:YypFdjt","49152:ypFdjth","49152:pFdjth8","49152:Fdjth8C","49152:djth8C/","49152:jth8C/G","49152:th8C/G1","49152:h8C/G1b","49152:8C/G1bw","49152:C/G1bw0","49152:/G1bw0i","49152:G1bw0iN","49152:1bw0iNJ","49152:bw0iNJO","49152:w0iNJOE","49152:0iNJOEY","49152:iNJOEYn","49152:NJOEYn1","49152:JOEYn1j","49152:OEYn1j7","49152:EYn1j75","49152:Yn1j75A","49152:n1j75AH","49152:1j75AHE","49152:j75AHEw","49152:75AHEw8","49152:5AHEw8u","49152:AHEw8uw","49152:HEw8uwW","49152:Ew8uwWq","49152:w8uwWqk","49152:8uwWqk/","49152:uwWqk/2","49152:wWqk/2l","49152:Wqk/2lh","49152:qk/2lhX","98304:TmbfQhr","98304:mbfQhr0","98304:bfQhr0H","98304:fQhr0Hc","98304:Qhr0Hci","98304:hr0Hcip","98304:r0Hcipd","98304:0HcipdK","98304:HcipdKv","98304:cipdKvj","98304:ipdKvjL","98304:pdKvjLY","98304:dKvjLYy","98304:KvjLYyp","98304:vjLYypF","98304:jLYypFd","98304:LYypFdj","98304:YypFdjt","98304:ypFdjth","98304:pFdjth8","98304:Fdjth8C","98304:djth8C/","98304:jth8C/G","98304:th8C/G1","98304:h8C/G1b","98304:8C/G1bw","98304:C/G1bw0","98304:/G1bw0i","98304:G1bw0iN","98304:1bw0iNJ","98304:bw0iNJO","98304:w0iNJOE","98304:0iNJOEY","98304:iNJOEYn","98304:NJOEYn1","98304:JOEYn1j","98304:OEYn1j7","98304:EYn1j75","98304:Yn1j75A","98304:n1j75AH","98304:1j75AHE","98304:j75AHEw","98304:75AHEw8","98304:5AHEw8u","98304:AHEw8uw","98304:HEw8uwW","98304:Ew8uwWq","98304:w8uwWqk","98304:8uwWqk/","98304:uwWqk/2","98304:wWqk/2l","98304:Wqk/2lh","98304:qk/2lhX","49152:TVznfj1","49152:Vznfj1n","49152:znfj1nT","49152:nfj1nT/","49152:fj1nT/G","49152:j1nT/G1","49152:1nT/G1l","49152:nT/G1lH","49152:T/G1lHE","49152:/G1lHEY","49152:G1lHEYn","49152:1lHEYn1","49152:lHEYn1j","49152:HEYn1j7","49152:1j75AH1","49152:j75AH1F","49152:75AH1F5","49152:5AH1F5M","49152:AH1F5MX"],"imphash":"d8b31f8c03e0c76ff245ed05a15ffe6c"},"file_info":{"file_name":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":4331392,"entropy":6.88,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785500141000,"last_seen":1787850060000,"last_multi_scan":1787850060000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":2,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":83},"sandbox_signatures":{"informative_count":181,"suspicious_count":18,"malicious_count":6,"total":205},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win64.Gsb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Vidar.830","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Vidar.830 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.HRGN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.cl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Loader.wl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 006e2b1c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Agent.MMK.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win64.75616","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Vidar","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"VidarStealer","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"HOOK SPIDER","sources":[{"report_type":"qsp","report_id":""}]},{"value":"VICE SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to detect sandbox environment via user account"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugObjectHandle"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with medium confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-13","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"internal/chacha8rand\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"*chacha8rand.State\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"chacha8\" (Indicator: \"chacha\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"3des\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"file/memory contains long string with (Indicator: \"QueryInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ReadDirectoryChange\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LookupAccountSid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetUserName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087","id":"string-452","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"file/memory contains long string with (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Process32Next\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Module32Next\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Process32First\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Module32First\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValue (in long string)\" in \"sample.bin\", Found registry query API: \"RegEnumValue (in long string)\" in \"sample.bin\", Found registry query API: \"RegOpenKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-118","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"file/memory contains long string with (Indicator: \"SetWaitableTimer\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1069.002","id":"string-981","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*godebugs.info\", Heuristic match: \"\t*abi.name\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"\nSetsockoptInt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSARecv\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSARecv\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087.001","id":"string-112","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-736","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"gethostbyname\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"wsastartup\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"wsacleanup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValue (in long string)\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-402","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileType\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegLoadMUIString (in long string)\" in \"sample.bin\", Found registry modification API: \"RegCreateKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtCreateFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtOpenFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\" Go build ID: \"HZsgxIFBQ5F6iOm7xpYS/9sNXYOE31IvEeASis0rN/UxuZANGGZBLJfRvikFBa/9uIR5tUAK1KlW3E-6Gpu\"\n \" (Indicator: \" Go build ID: \"HZsgxIFBQ5F6iOm7xpYS/9sNXYOE31IvEeASis0rN/UxuZANGGZBLJfRvikFBa/9uIR5tUAK1KlW3E-6Gpu\"\n )\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-74","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1136.001","id":"string-214","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$38","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptAcquireContext\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CertCloseStore\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in \"sample.bin\", Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-223","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1531","id":"string-216","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Aes6U\" (Indicator: \"Aes\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001672.00000001.167626.E45C0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003932.00000001.164597.12090000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001672.00000001.167626.00400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007316.00000001.166068.00380000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$39","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00006060]\n Process \"WerFault.exe\" [UID: 00000000-00006084]\n Process \"WerFault.exe\" [UID: 00000000-00006092]\n Process \"WerFault.exe\" [UID: 00000000-00005984]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005304.00000000.167208.029F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002036-00000C2C-1541910476\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00002036-00000C2C-1541910544\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002036-00000C2C-1541910567\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00002036-00000C2C-1541910594\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002036-00000C2C-1541910623\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002036-00000C2C-1541910642\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001672.00000001.167626.E45C0000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003932.00000001.164597.12090000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00001672.00000001.167626.EBED0000.00000004.mdmp\")\n Found string \"qqqqqqqqqqqqqqqqogin.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.ct\" (Indicator: \"youtube.com\"; Source: \"00000000-00003932.00000001.164597.12090000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00003932.00000001.164597.12090000.00000004.mdmp\")\n Found string \"/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object\" (Indicator: \"youtube.com\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")\n Found string \"steampowered.com/ https://www.youtube.com https://www.youtube-no\" (Indicator: \"youtube.com\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002036-00000C2C-1541425119\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002036-00000C2C-1541425119\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"postmessage\"; Source: \"00000000-00003932.00000001.164597.59A14000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002036)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002036)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005040)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002344)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003932)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002036)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005040)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002344)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003932)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007316)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004876)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004908)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003932-00000C17-1544873901\n \"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003932-00000C17-1544875588\n \"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007316-00000C17-1569328588\n \"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007316-00000C17-1569332392\n \"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001672-00000C17-1592404695\n \"rundll32.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001672-00000C17-1592407359","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has section name .rdata with entropy \"7.153650372168676\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00002036.00000000.162993.00100000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002260.00000000.166362.00080000.00000004.mdmp\")\n Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00002344.00000000.162994.00100000.00000004.mdmp\")\n Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00003396.00000001.167620.00080000.00000004.mdmp\")\n Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00003932.00000001.164597.00080000.00000004.mdmp\")\n Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00004876.00000001.165698.00080000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")\n Found string \"C:\\WINDOGetCommandLineW\" (Source: \"00000000-00005040.00000000.162993.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"rundll32.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\250a1534 (UID: 00000000-00003932)\n \"rundll32.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\1b16cb48 (UID: 00000000-00007316)\n \"rundll32.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\f0238648 (UID: 00000000-00001672)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"t.me\"\n \"steamcommunity.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"37.27.204.215:443\"\n \"149.154.167.99:443\"\n \"23.48.8.218:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 44857-9985-00000001E5E77758","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$40","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process rundll32.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse\"\n Process rundll32.exe created mutex with name \"Gernsoalse\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00001672.00000001.167626.E45C0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00003932.00000001.164597.12090000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00007316.00000001.166068.580A0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 12AA0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 12350000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 16040000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" was detected as \"MinGW\" and name: \"Compiler\"\n \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an writable section named \".data\"\n \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an writable section named \".bss\"\n \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an writable section named \".idata\"\n \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an writable section named \".CRT\"\n \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" file has an entrypoint instructions - \"mov\trax, qword ptr [rip + 0x3b1e59],mov\tdword ptr [rax], 0,jmp\t0x1e5ce1200,nop\tword ptr cs:[rax + rax],nop\tdword ptr [rax],mov\trdx, rcx,lea\trcx, [rip + 0x3b9c86],jmp\t0x1e5e7d920,nop\t,lea\trcx, [rip + 9],jmp\t0x1e5ce1370,nop\tdword ptr [rax],ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,jmp\tqword ptr [rax],outsd\tdx, dword ptr [rsi],and\tbyte ptr [rdx + 0x75], ah,imul\tebp, dword ptr [rsp + riz*2 + 0x20], 0x203a4449,and\tcl, byte ptr [rax + 0x5a],jae\t0x1e5ce141b,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x19ce00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x206800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x19cde0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x2066a0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has high imagebase \"0x1e5ce0000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00002036) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00002036) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"steamcommunity.com\"\n \"t.me\"\n \"vog.peluangsm188.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 466921)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$47","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 2036)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003932)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001672)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect sandbox environment via user account\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\rundll32.exe.mui\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\326936B32576E55384CA2034D68EF83BE41341A9979FD2CC0054E76396FF7A39.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\326936B32576E55384CA2034D68EF83BE41341A9979FD2CC0054E76396FF7A39.BIN.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\326936B32576E55384CA2034D68EF83BE41341A9979FD2CC0054E76396FF7A39.BIN.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\326936B32576E55384CA2034D68EF83BE41341A9979FD2CC0054E76396FF7A39.BIN.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$4a","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$4b","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /gk6p2s\"\n Found http requests in header \"POST /gk6p2s\"\n Found http requests in header \"GET /profiles/76561198667588759\"\n Found http requests in header \"POST /profiles/76561198667588759\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"561198667588759 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001672.00000001.167626.E45C0000.00000004.mdmp\")\n Found string \"POST /gk6p2s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001672.00000001.167626.E45C0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001672.00000001.167626.EBED0000.00000004.mdmp\")\n Found string \"POST /gk6p2s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003932.00000001.164597.12090000.00000004.mdmp\")\n Found string \"561198667588759 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")\n Found string \"6561198667588759 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")\n Found string \"POST /gk6p2s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007316.00000001.166068.580A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"vog.peluangsm188.top\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:27060\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://t.me/gk6p2s\n Found HTTPS POST request to https://t.me/gk6p2s\n Found HTTPS GET request to https://steamcommunity.com/profiles/76561198667588759\n Found HTTPS POST request to https://steamcommunity.com/profiles/76561198667588759","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"steamcommunity.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"37.27.204.215\" on port \"443\"\n HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"23.48.8.218\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$51","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"$52","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002036.00000000.162993.EE0F9000.00000002.mdmp\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002036.00000000.162993.EE0F9000.00000002.mdmp\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002036.00000000.162993.EE0F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00002036.00000000.162993.EE0F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003932.00000001.164597.EE0F6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_FA49926A\"; Value: \"8244CE4\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004908.00000001.165694.B1D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001672.00000001.167626.EBED0000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00003932.00000001.164597.599F0000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00007316.00000001.166068.7F960000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" has section name .rdata with entropy \"7.153650372168676\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"rundll32.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugObjectHandle","description":"\"rundll32.exe queries ProcessDebugObjectHandle (UID: 2036), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 5040)\n \"rundll32.exe queries ProcessDebugObjectHandle (UID: 2344), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 7316)\n \"rundll32.exe queries ProcessDebugObjectHandle (UID: 4876), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 4908)\n \"rundll32.exe queries ProcessDebugObjectHandle (UID: 7120), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 6000)\n \"rundll32.exe queries ProcessDebugObjectHandle (UID: 2260), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 3396)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-240","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$55","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$56","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 37.27.204.215 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 23.48.8.218 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"$57","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"rundll32.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00002036)\n \"rundll32.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00002036)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$58","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n GetThreadContext\n Sleep\n VirtualProtect\n WriteFile\n GetSystemDirectoryA\n GetProcAddress\n CreateThread\n GetSystemInfo\n LoadLibraryExW\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 149.154.167.99:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$5a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"intel_graph":{"map":{"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd":{"type":"Adversary","value":"VICE SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548":{"type":"Adversary","value":"HOOK SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:91830aeeac8ac9919cb41671b87257759375a979aef16a9e2c46942314669d0a":{"type":"Domain","value":"steamcommunity.com","verdict":{"verdict":"unknown"}},"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25":{"type":"Domain","value":"t.me","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:ebf64971d9e0378bee2c5b35b78db29f80d93aa8453af497319453dd2781a928":{"type":"Domain","value":"vog.peluangsm188.top","verdict":{"verdict":"unknown"}},"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39":{"type":"File","value":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 19 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6":{"type":"File","value":"34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 4 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1":{"type":"File","value":"b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb":{"type":"File","value":"c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 4 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Ip:23.48.8.218":{"type":"Ip","value":"23.48.8.218"},"Ip:37.27.204.215":{"type":"Ip","value":"37.27.204.215"},"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21":{"type":"Threat","value":"VidarStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},"Url:/gk6p2s":{"type":"Url","value":"/gk6p2s"},"Url:/profiles/76561198667588759":{"type":"Url","value":"/profiles/76561198667588759"},"Url:1942c6abab26e5a381625ae419dc693e87c066d8522840954119aa22bba55f40":{"type":"Url","value":"https://t.me:443/gk6p2s","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:1dc621bb56ccdf848c6a961765f957feae72bbe8c65ea4471a77252ece99eda7":{"type":"Url","value":"https://steamcommunity.com:443/profiles/76561198667588759","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:ad18dd236cb82630af0a6898d3771bc87f86f6990fd39c2e00ac0121623859b2":{"type":"Url","value":"https://37.27.204.215:443/","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542579730840300201","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1542579727647870313","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:91830aeeac8ac9919cb41671b87257759375a979aef16a9e2c46942314669d0a"}],"verdict":{"verdict":"unknown"}},{"id":"1542579750794094957","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1542579727635287364","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:ebf64971d9e0378bee2c5b35b78db29f80d93aa8453af497319453dd2781a928"}],"verdict":{"verdict":"unknown"}},{"id":"1542579727639481669","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1"}],"verdict":{"verdict":"unknown"}},{"id":"1542579737381835751","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1542579727647870323","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6"},{"edge_kind":"is_threat","from_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727652064633","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6"},{"edge_kind":"contains_c2_config","from_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6","to_key":"Url:1942c6abab26e5a381625ae419dc693e87c066d8522840954119aa22bba55f40"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870327","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6"},{"edge_kind":"contains_c2_config","from_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6","to_key":"Url:1dc621bb56ccdf848c6a961765f957feae72bbe8c65ea4471a77252ece99eda7"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870325","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6"},{"edge_kind":"contains_c2_config","from_key":"File:34f8ea6839aa7749c89598ce725d763833c698a9d9964a7541ad7600f6930ab6","to_key":"Url:ad18dd236cb82630af0a6898d3771bc87f86f6990fd39c2e00ac0121623859b2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870322","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb"},{"edge_kind":"is_threat","from_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870328","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb"},{"edge_kind":"contains_c2_config","from_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb","to_key":"Url:1942c6abab26e5a381625ae419dc693e87c066d8522840954119aa22bba55f40"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870326","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb"},{"edge_kind":"contains_c2_config","from_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb","to_key":"Url:1dc621bb56ccdf848c6a961765f957feae72bbe8c65ea4471a77252ece99eda7"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579727647870324","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"memory","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb"},{"edge_kind":"contains_c2_config","from_key":"File:c4e34717b8a7f65c636800349a4ae835dd31bdcbf784a8cae255daaa398732bb","to_key":"Url:ad18dd236cb82630af0a6898d3771bc87f86f6990fd39c2e00ac0121623859b2"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542579734847975753","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542579734843781448","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"contacted_ip","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Ip:37.27.204.215"},{"edge_kind":"contacted_ip","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Ip:23.48.8.218"},{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25"},{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:ebf64971d9e0378bee2c5b35b78db29f80d93aa8453af497319453dd2781a928"},{"edge_kind":"contacted_domain","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Domain:91830aeeac8ac9919cb41671b87257759375a979aef16a9e2c46942314669d0a"},{"edge_kind":"contacted_url","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Url:/gk6p2s"},{"edge_kind":"contacted_url","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"Url:/profiles/76561198667588759"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","edges":[{"edge_kind":"extracted","from_key":"File:326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39","to_key":"File:b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":35,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":35,"embedded_ips_count":0,"embedded_domains_count":3,"embedded_urls_count":3,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Multi-Process","Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"6a7f43f15823ba816c040233","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenKryptik.Win64","contacted_countries":["FIN","NLD","USA"],"submit_name":"326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin","analysis_start_time":"2026-08-14T16:36:14+00:00","indicators_count":{"informative":179,"suspicious":39,"malicious":4},"tags":["Multi-Process","Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"37.27.204.215","port":443,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"address":"23.48.8.218","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"dns_resolutions":[{"domain":"t.me","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"domain":"vog.peluangsm188.top","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"domain":"steamcommunity.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/gk6p2s","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gk6p2s HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"host":"steamcommunity.com","host_ip":"23.48.8.218:443","url":"/profiles/76561198667588759","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /profiles/76561198667588759 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0\nHost: steamcommunity.com","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"embedded_domains":[{"value":"t.me","sources":[{"report_type":"qsp","report_id":""}]},{"value":"vog.peluangsm188.top","sources":[{"report_type":"qsp","report_id":""}]},{"value":"steamcommunity.com","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"https://t.me:443/gk6p2s","sources":[{"report_type":"qsp","report_id":""}]},{"value":"https://steamcommunity.com:443/profiles/76561198667588759","sources":[{"report_type":"qsp","report_id":""}]},{"value":"https://37.27.204.215:443/","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}],"processes":[{"pid":4888,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00004888"},{"pid":2036,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002036","icon":"$5b"},{"pid":5040,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#4","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005040","icon":"$5c"},{"pid":2344,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#3","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002344","icon":"$5d"},{"pid":3932,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#2","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003932","icon":"$5e"},{"pid":7316,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#5","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007316","icon":"$5f"},{"pid":4876,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#6","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00004876","icon":"$60"},{"pid":4908,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#7","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00004908","icon":"$61"},{"pid":7120,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#8","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007120","icon":"$62"},{"pid":6000,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#9","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006000","icon":"$63"},{"pid":1672,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#10","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001672","icon":"$64"},{"pid":2260,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#11","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002260","icon":"$65"},{"pid":3396,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#12","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003396","icon":"$66"},{"pid":5304,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll\",#13","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005304","icon":"$67"},{"pid":6084,"ppid":5304,"name":"WerFault.exe","command_line":"-u -p 5304 -s 356","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005304","uid":"00000000-00006084"},{"pid":6092,"ppid":5304,"name":"WerFault.exe","command_line":"-u -p 5304 -s 356","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005304","uid":"00000000-00006092"},{"pid":5984,"ppid":5304,"name":"WerFault.exe","command_line":"-u -p 5304 -s 356","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005304","uid":"00000000-00005984"},{"pid":6060,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 392 -p 5304 -ip 5304","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006060","icon":"$68"}],"all_imported_dlls":["ntasn1.dll","ncryptsslp.dll","imagehlp.dll","imm32.dll","dwmapi.dll","powrprof.dll","OnDemandConnRouteHelper.dll","msasn1.dll","ntdll.dll","msvcrt.dll","msvcp_win.dll","webio.dll","schannel.dll","mskeyprotect.dll","vcruntime140.dll","ole32.dll","user32.dll","gdi32full.dll","oleaut32.dll","nsi.dll","sspicli.dll","cryptbase.dll","gdi32.dll","msvcp140.dll","cryptsp.dll","bcrypt.dll","bcryptprimitives.dll","mswsock.dll","dnsapi.dll","dpapi.dll","KernelBase.dll","rpcrt4.dll","VxSSL64.dll","uxtheme.dll","vcruntime140_1.dll","rasadhlp.dll","rsaenh.dll","crypt32.dll","FWPUCLNT.DLL","326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39.bin.dll","msctf.dll","advapi32.dll","sechost.dll","winhttp.dll","IPHLPAPI.DLL","win32u.dll","fltLib.dll","gpapi.dll","kernel32.dll","ucrtbase.dll","winmmbase.dll","winnsi.dll","ws2_32.dll","shlwapi.dll","combase.dll","SHCore.dll","winmm.dll","cfgmgr32.dll","ncrypt.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1","sha256":"b2ff6e72b18e3a7eaabd6d55798be3c6359e4734baccfa5a89e2f9c188eaf5e1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a7f43f15823ba816c040233"}]}]}},"report_ids":{"sandbox_job_ids":["6a7f43f15823ba816c040233"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Vidar Sample 326936b32576… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 326936b32576…. Malware family: Trojan.Vidar. Threat score 100/100. 13/25 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Vidar Sample 326936b32576… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 326936b32576…. Malware family: Trojan.Vidar. Threat score 100/100. 13/25 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/326936b32576e55384ca2034d68ef83be41341a9979fd2cc0054e76396ff7a39"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Vidar Sample 326936b32576… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 326936b32576…. Malware family: Trojan.Vidar. Threat score 100/100. 13/25 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L69","11",{}]] 32:null