26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample be93679dad8f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample be93679dad8f…. Malware family: Trojan.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 12 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6"],"about":{"@type":"SoftwareApplication","name":"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T61a,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez" (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp")28:Tc3a,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.209954.0F240000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "CloseHandleReadFileWaitForSingleObjectPeekNamedPipeWiFi Networks Report>" (Indicator: "WaitForSingleObject"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp")29:T806,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "LoadLibraryA:" (Indicator: "LoadLibrary"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "}nNLoadLibraryWGetLastError _" (Indicator: "LoadLibrary"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "LoadLibraryA:" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp") Found reference to API "}nNLoadLibraryWGetLastError _" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "LoadLibraryAuser32.dll" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp")2a:T41e,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_.^" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_.^" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_.sing" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_.sing" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp")2b:T5e1,Observed string: "/AmsiScanBuffer+[PATCH] AMSI: polymorphic patch generated (" (Indicator: "amsiscanbuffer") in Source: be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin Observed string: "[PATCH] AMSI: AmsiScanBuffer not found[PATCH] AMSI: amsi.dll not loaded, skip[PATCH] AMSI: HVCI detected, skipped" (Indicator: "amsi.dll") in Source: be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin Observed string: "[PATCH] AMSI: AmsiScanBuffer not found[PATCH] AMSI: amsi.dll not loaded, skip[PATCH] AMSI: HVCI detected, skipped" (Indicator: "amsiscanbuffer") in Source: be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00004376.00000000.209197.0F240000.00000004.mdmp 00000000-00004376.00000001.209954.0F240000.00000004.mdmp Observed string: "/ AmsiScanBuffer+[PATCH] AMSI: polymorphic patch generated (" (Indicator: "amsiscanbuffer") in Source: 00000000-00004376.00000000.209197.19261000.00000020.mdmp Observed string: "[PATCH] AMSI: AmsiScanBuffer not found[PATCH] AMSI: amsi.dll not loaded, skip[PATCH] AMSI: HVCI detected, skipped" (Indicator: "amsi.dll") in Source: 00000000-00004376.00000000.209197.19261000.00000020.mdmp Observed string: "[PATCH] AMSI: AmsiScanBuffer not found[PATCH] AMSI: amsi.dll not loaded, skip[PATCH] AMSI: HVCI detected, skipped" (Indicator: "amsiscanbuffer") in Source: 00000000-00004376.00000000.209197.19261000.00000020.mdmp2c:T778,"EAdminWindowsx64x86_64" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "pProcessorNameStringGetDiskFreeSpaceExWC:\>EAdminWindowsx64x86_64" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "countryCoderegionNamecityispGetUserDefaultLocaleNameen-USGlobalMemoryStatusEx.GrCK" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "countryCoderegionNamecityispGetUserDefaultLocaleNameen-USGlobalMemoryStatusEx.GrCK" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp")38:T582,Found system information discovery API: "GetEnvironmentStringsW" in file "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin" Found system information discovery API: "RtlNtStatusToDosError" in file "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004376.00000001.209954.0F240000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp" Found system information discovery API: "ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez" in "00000000-00004376.00000001.209954.80001000.00000020.mdmp"39:T1643,"" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{59CED" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "y\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser4CC.chrome" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser\Application" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera GX Stable(64-bit)" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera Stableaming/crl.com" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser\Application2" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browsercal" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}r" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "brave.exeBraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004376.00000001.209954.80001000.00000020.mdmp44:Te2f,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376-00000C9D-15932032817") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.06" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.0.0 Safari/537.3636" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp") Found string "!Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" (Indicator: "user-agent: "; Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0tq==dbon" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3653e.png" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp")45:Tcb3,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004376.00000000.209197.0F240000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DAA359205724}" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam Data >" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "system\currentcontrolset\control\session manager\environment" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004376.00000001.209954.0F240000.00000004.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser4CC.chrome" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser\Application" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera GX Stable(64-bit)" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera Stableaming/crl.com" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser\Application2" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browsercal" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}r" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{59CED" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "y\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A" in Source: 00000000-00004376.00000001.209954.11490000.00000004.mdmp "brave.exeBraveSoftware\Brave-Browser\User Data" in Source: 00000000-00004376.00000001.209954.80001000.00000020.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00004824.00000000.209763.DD3DB000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00004824.00000000.209763.DD3DB000.00000002.mdmp46:Tb85,"rem adapted from https://github.com/microsoft/windows-dev-box-setup-scripts/blob/79bbe5bdc4867088b3e074f9610932f8e4e192c2/readme.md#legalmfsienbifjvb3q=" (Indicator: "github.com") "' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwho" (Indicator: "discordapp.com") "0Fnsafe-eval' https://cdn.jsdelivr.net https://cdn.socket.io https://unpkg.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwhois.io; connect-src 'self' https: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" (Indicator: "discordapp.com") "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdn.socket.io https://unpkg.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwhois.io; connect-src 'self' https: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" (Indicator: "discordapp.com") "raschi](https://github.com/lucamaraschi) -" (Indicator: "github.com") "* [lundibundi](https://github.com/lundibundi) -" (Indicator: "github.com") "* [lxe](https://github.com/lxe) -" (Indicator: "github.com") "* [maclover7](https://github.com/maclover7) -" (Indicator: "github.com") "* [mafintosh](https://github.com/mafintosh) -" (Indicator: "github.com") "* [matthewloring](https://github.com/matthewloring) -" (Indicator: "github.com") "* [micnic](https://github.com/micnic) -" (Indicator: "github.com") "* [mikeal](https://github.com/mikeal) -" (Indicator: "github.com") "* [miladfarca](https://github.com/miladfarca) -" (Indicator: "github.com") "* [misterdjules](https://github.com/misterdjules) -" (Indicator: "github.com") "* [mmarchini](https://github.com/mmarchini) -" (Indicator: "github.com") "mocha](https://github.com/orangemocha) -" (Indicator: "github.com") "* [othiym23](https://github.com/othiym23) -" (Indicator: "github.com") "* [oyyd](https://github.com/oyyd) -" (Indicator: "github.com") "* [petkaantonov](https://github.com/petkaantonov) -" (Indicator: "github.com") "* [phillipj](https://github.com/phillipj) -" (Indicator: "github.com") "* [piscisaureus](https://github.com/piscisaure?" (Indicator: "github.com") "* [pmq20](https://github.com/pmq20) -" (Indicator: "github.com") "* [PoojaDurgad](https://github.com/PoojaDurgad) -" (Indicator: "github.com") "* [princejwesley](https://github.com/princejwesley) -" (Indicator: "github.com") "* [psmarshall](https://github.com/psmarshall) -" (Indicator: "github.com")47:T2044,"GET /sadwfawx12 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat 02 May 2026 12:27:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12525 Connection: keep-alive Set-Cookie: stel_ssid=4c0c3b084d5d85ceb3_16966410673203974365; expires=Sun 03 May 2026 12:27:37 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: momentum-effects-anderson-conferencing.trycloudflare.com" Response ==> HTTP/1.1 302 Found Date: Sat 02 May 2026 12:27:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Location: /login CF-Ray: 9f5705664c8b58dc-SJC CF-Cache-Status: DYNAMIC Server: cloudflare Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Cookie content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdn.socket.io https://unpkg.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwhois.io; connect-src 'self' https: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin permissions-policy: accelerometer=() camera=() geolocation=() gyroscope=() magnetometer=() microphone=() payment=() usb=() referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-correlation-id: 50c4f298-5108-46f7-9890-b0d5c3ef4012 x-frame-options: DENY x-request-id: 50c4f298-5108-46f7-9890-b0d5c3ef4012 x-xss-protection: 1; mode=block with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D656E3E0A3C7469746C653E5265646972656374696E672E2E2E3C2F7469746C653E0A3C6831....... "GET /assets/cache/1a1afe4c-27ad-457c-8ee2-13ae6de5753e.png HTTP/1.1 Connection: Keep-Alive Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Host: momentum-effects-anderson-conferencing.trycloudflare.com" Response ==> HTTP/1.1 200 OK Date: Sat 02 May 2026 12:27:38 GMT Content-Type: image/png Content-Length: 1063872 Connection: keep-alive CF-Ray: 9f57056a0ab758dc-SJC CF-Cache-Status: DYNAMIC Cache-Control: public max-age=31536000 Content-Disposition: inline; filename=1a1afe4c-27ad-457c-8ee2-13ae6de5753e.png ETag: "1777724614.9999597-1063872-1966348959" Last-Modified: Sat 02 May 2026 12:23:34 GMT Server: cloudflare Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Cookie content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdn.socket.io https://unpkg.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwhois.io; connect-src 'self' https: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin permissions-policy: accelerometer=() camera=() geolocation=() gyroscope=() magnetometer=() microphone=() payment=() usb=() referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-correlation-id: 5c733f27-e3df-41f5-b53c-00c975df74ae x-frame-options: DENY x-request-id: 5c733f27-e3df-41f5-b53c-00c975df74ae x-xss-protection: 1; mode=block with response body ==>C289504E470D0A1A0A0000000D4948445200002000000010C3A0080200000043C3AFC3A3C39E000100004944415478C39AC3ACC39DC3816DC383400C00415250....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.ipify.org" Response ==> HTTP/1.1 200 OK Date: Sat 02 May 2026 12:27:39 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: 9f570573b955f9e4-SJC with response body ==>36342E3132342E31322E313632....... "GET /json/64.124.12.162 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ip-api.com" Response ==> HTTP/1.1 200 OK Date: Sat 02 May 2026 12:27:39 GMT Content-Type: application/json; charset=utf-8 Content-Length: 277 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322....... "GET /sadwfawx12 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat 02 May 2026 12:27:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12524 Connection: keep-alive Set-Cookie: stel_ssid=9a77a8f76ff2f949ef_13498355114154856639; expires=Sun 03 May 2026 12:27:46 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: momentum-effects-anderson-conferencing.trycloudflare.com" Response ==> HTTP/1.1 302 Found Date: Sat 02 May 2026 12:27:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Location: /login CF-Ray: 9f57059fe94d58dc-SJC CF-Cache-Status: DYNAMIC Server: cloudflare Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Cookie content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdn.socket.io https://unpkg.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob: https: https://ui-avatars.com https://cdn.discordapp.com https://cdn.ipwhois.io; connect-src 'self' https: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin permissions-policy: accelerometer=() camera=() geolocation=() gyroscope=() magnetometer=() microphone=() payment=() usb=() referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-correlation-id: e5e22747-1ebd-497e-a137-46c0b60a5b00 x-frame-options: DENY x-request-id: e5e22747-1ebd-497e-a137-46c0b60a5b00 x-xss-protection: 1; mode=block with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D656E3E0A3C7469746C653E5265646972656374696E672E2E2E3C2F7469746C653E0A3C6831.......48:T1724,"lmemhcolhnd-phttps://momentum-effects-anderson-conferencing.trycloudflare.comoint:tls-server-end-point:;'j2%rqwvalidating" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com@ee+@sg" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://polygon-bor-rpc.publicnode.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*list" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing]" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/momentum-effects-anderson-conferencing.trycloudflare.commetadata" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094connecting" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.nhhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4whrb+a6" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-security-policy:" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://web.telegram.orgstrict-transport-security:" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=maltoji3u-gf&l=english&_cdn=akamai" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=jcbei8fbyiqf&l=english&_cdn=akamai" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=cg_vulfg2ioa&l=english&_cdn=akamai" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/98dcfd7a11a7f6a8f51783f6273138e67f24e321_full.jpg" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094/badges" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://support.steampowered.com/kb_article.php?ref=6899-iosk-9514&l=english" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094/inventory/" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://t.me/sadwfawx12" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp") Found URL "https://polygon-bor-rpc.publicnode.com/polygon-bor-rpc.publicnode.compolygon-bor-rpc.publicnode.comblicno.comrchived" - Source: "00000000-00004376.00000001.209954.0F240000.00000004.mdmp") Found URL "https://t.me/sadwfawx12https://api.ipify.org/momentum-effects-anderson-conferencing.trycloudflare.comteamcommunity.commomentum-effects-anderson-conferencing.trycloudflare.comttps://momentum-effects-anderson-conferencing.trycloudflare.com:443/api/logt.mepolygon-bor-rpc.publicnode.compolygon-bor-rpc.publicnode.comsafd" - Source: "00000000-00004376.00000001.209954.0F240000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004376.00000001.209954.0F240000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094efast.met.mesteamcommunity.comsteamcommunity.comdc238bff48a31d55a97e1e93892934b_080dc7a65db6a5960ecd874088f3328_a7611428d62805a3e4e5bc4103d82e4_cf244f1a10d4dbed0d88eba0c43a9b5_f1583fff42fff476a09801acb69213f_46e7b0f942663a1edc8d9d6d7869173_457a8ce4b2a7499f8299a013b6e1c7c_cf244f1a10d4dbed0d88eba0c43a9b5_23de96ee265046957a660ed7c9dd9e7_080dc7a65db6a5960ecd874088f3328_etwork" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://t.me/pubwshapubwust)oftware\policies\microsoft\systemcertificates\trusticrosoft" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/ip-api.commomentum-effects-anderson-conferencing.trycloudflare.commicrosoft" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/assets/cache/1a1afe4c-27ad-457c-8ee2-13ae6de5753e.png" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/api/loge.com/api/logog" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://api.ipify.org" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com>https://momentum-effects-anderson-conferencing.trycloudflare.comoint:resolved" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comvalidating" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comresolved" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com@sg" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comgs" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*list" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://polygon-bor-rpc.publicnode.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://github.com/microsoft/windows-dev-box-setup-scripts/blob/79bbe5bdc4867088b3e074f9610932f8e4e192c2/readme.md" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/assets/cache/1a1afe4c-27ad-457c-8ee2-13ae6de5753e.pngt" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/api/log" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://fonts.googleapis.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://cdnflare.com;" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://fonts.gstatic.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com;" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://ui-avatars.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://cdn.discordapp.com" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://cdn.ipwhoion" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-security-policy:" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://web.telegram.orgstrict-transport-security:" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=maltoji3u-gf&l=english&_cdn=akamai" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=jcbei8fbyiqf&l=english&_cdn=akamai" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=cg_vulfg2ioa&l=english&_cdn=akamai" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/98dcfd7a11a7f6a8f51783f6273138e67f24e321_full.jpg" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094/badges" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://support.steampowered.com/kb_article.php?ref=6899-iosk-9514&l=english" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094/inventory/" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://t.me/sadwfawx12" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found URL "https://www.mibbit.com/?url=%s" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://compose.mail.yahoo.com/?om/?url=%s" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://cdn.jsdelivr.net" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://cdn.socket.io" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://unpkg.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://static.cloudflareinsights.com;" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://fonts.googleapis.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com;" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://fonts.gstatic.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://ui-avatars.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://cdn.discordapp.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://cdn.ipwhois.io;" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://ntp.mextensions" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://ntpnode_modulesacrodataoopemobaxterm://ntp.msn.commicrosoftesion_trace_ls_connectionsn.comonesvccredential//ntp.msn.comqwen" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://ntprogramdataagecachingfeamicrosofts://ntp.msn.comnode_modulestps://ntp.msprogramdatanode_modulesdata_" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://>package" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://ntp.authorized_keysadymarkermobaxterm_https://ntp.msopenai_api_key=9f6a9b15bextensionstps://ntp.msn.recentservers[" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/api/log" - Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found URL "https://rpc-mainnet.matic.quiknode.proyinitialized" - Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/...initialized" - Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp") Found URL "https://polygon-bor-rpc.publicnode.com===" - Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp") Found URL "https://www^eyjhbgcioijiuzi1niisnullxterraform" - Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp") Found URL "https://virclaude" - Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp") Found URL "https://warnyputbytes.info.29,info.1" - Source: "00000000-00004376.00000001.209954.11A42000.00000004.mdmp") Found URL "https://1rpc.io/matic0x3bc5de30kubeconfigpreferencesstatic_salt_882aliveauthorized_keysterraformstarting" - Source: "00000000-00004376.00000001.209954.11A50000.00000004.mdmp") Found URL "https://t.me/static_salt_882http" - Source: "00000000-00004376.00000001.209954.11A50000.00000004.mdmp") Found URL "https://polygon-bor-rpc.publicnode.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://api.ipify.org" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "http://ip-api.com/json/64.124.12.162" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199515014094" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://t.me/sadwfawx12" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-ander" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.com/api/log" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/lucamaraschi)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/lundibundi)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/lxe)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/maclover7)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mafintosh)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/matthewloring)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/micnic)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mikeal)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/miladfarca)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/misterdjules)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mmarchini)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/orangemocha)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/othiym23)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/oyyd)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/petkaantonov)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/phillipj)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/piscisaure?" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/pmq20)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/poojadurgad)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/princejwesley)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/psmarshall)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/puzpuzpuz)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/raisinten)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/refack)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rexagod)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rickyes)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rlidwka)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github." - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/robertkowalski)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/romankl)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/ronkorving)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rreverser)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rubys)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rvagg)rod" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/ryzokuken)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/saghul)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/sam-github)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/sebdeckers)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/seishun)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/shisama)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/silverwind)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/starkwang)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/stefanmb)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/tellnes)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/thlorenz)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/timothygu)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/trevnorris)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/tunniclm)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/vdeturckheims*vladimir" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/vkurchatkin)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/vsemozhetbyt)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/watson)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/whitlockjc)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/yhwang)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/yorkie)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/yosuke-furukawa)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/atlowchemi)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/ayase-252)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/bmuenzenmeyer)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/canadahonk)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/daeyeon)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/f3n67u)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/himadriganguly)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/iam-frankqiu)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/marsonya)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/meixg)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mertcanaltin)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mesteery)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/preveen-stack)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/redyetidev)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/voltrexkeyva)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/bengl)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/juanarbol)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/rafaelgss)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mcollina)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/joesepi)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/mhdawson)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://opensource.org/licenses/mit)." - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.cqs/node/blob/head/license)" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/nodejs/admin/blob/head/code_of_conduct.md[contributing" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://nodejs.org/[openjs" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://openjsf.org/[strategic" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://github.com/nodejs/tsc/blob/head/working_groups.mdcontent-disposition:" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comm/api/logtls-server-end-point:content-disposition:" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comtls-server-end-point:content-disposition:" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comcontent-disposition:" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://momentum-effects-anderson-conferencing.trycloudflare.comget" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://cdn.jsdelivr.net" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://cdn.socket.io" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://unpkg.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://static.cloudflareinsights.com;" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://fonts.googleapis.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com;" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://fonts.gstatic.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://ui-avatars.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://cdn.discordapp.com" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found URL "https://cdn.ipwhois.io;" - Source: "00000000-00004376.00000001.209954.11A62000.00000004.mdmp")5c:T660,GET /sadwfawx12 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: t.me GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: momentum-effects-anderson-conferencing.trycloudflare.com GET /assets/cache/1a1afe4c-27ad-457c-8ee2-13ae6de5753e.png HTTP/1.1 Connection: Keep-Alive Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Host: momentum-effects-anderson-conferencing.trycloudflare.com GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.ipify.org GET /json/64.124.12.162 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ip-api.com GET /sadwfawx12 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: t.me GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: momentum-effects-anderson-conferencing.trycloudflare.com 5d:Tdf4,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "AES-256-CTR)" (Indicator: "aes"; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found string "1777750065|SUCCESS|SENDER|Payload encrypted (AES-GCM)||4275235571" (Indicator: "aes"; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11970000.00000004.mdmp, 00000000-00004376.00000001.209954.11A62000.00000004.mdmp") Found string "id_ecdsa" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp, 00000000-00004376.00000001.209954.119AD000.00000004.mdmp, 00000000-00004376.00000001.209954.11A42000.00000004.mdmp") Found string "id_ecdsa5" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found string "id_ecdsa4" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp, 00000000-00004376.00000001.209954.11A42000.00000004.mdmp") Found string "id_ecdsa[" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp") Found string ".ideaes"o" (Indicator: "aes"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsaJ" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsa:" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsa<>" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsaP<" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsaD3n" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsaG2i" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.11970000.00000004.mdmp"), Found string "id_ecdsa@6" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsau$" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsaD[" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsaeZ" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsa;Z" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsadY" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsaZY" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsa*N" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp"), Found string "id_ecdsa N" (Indicator: "ecdsa"; Source: "00000000-00004376.00000001.209954.119AD000.00000004.mdmp")5e:T486,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp")5f:Td3d,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "NtQueryInformationProcessTJ" (Indicator: "QueryInformationProcess"; Source: "00000000-00004376.00000001.209954.11490000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004376.00000001.209954.11B7F000.00000004.mdmp") Found reference to API "GetCurrentProcess0" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000001.209954.80001000.00000020.mdmp") Found reference to API "Oi\" (Indicator: \"software\\wow6432node\\valve\\steam\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"\"compression_ratio\": 1.0,\" (Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.119AD000.00000004.mdmp\")\n Found string \"1777750065|INFO|COMPRESS_INIT|Starting in-memory compression\" (Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"Starting in-memory compression\" (Source: \"00000000-00004376.00000001.209954.11A62000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found string \"ZipWriter was already closedUnsupported compression levelAES compression is not supported for writingUnsupported compression0\" (Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"ERRORCRITICALC2_RESOLVERC2ResC2ValCRYPTOSENDERTELEMETRYSAFETYC2ClientHttpClient\" (Indicator: \"RC2\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found reference to \"ERRORCRITICALC2_RESOLVERC2ResC2ValCRYPTOSENDERTELEMETRYSAFETYC2ClientHttpClient\" (Indicator: \"RC2\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp\")\n Found reference to \"INFOid\" (Indicator: \"Oid\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"BCryptOpenAlgorithmProviderBCryptCloseAlgorithmProviderBCryptGenerateSymmetricKeyBCryptDecryptBCryptDestroyKeyBCryptSetPropertyChainingModeAESChainingModeGCMBCryptEncryptCryptUnprotectDataLocalFreecrypt32.dll\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"file/memory contains long string with (Indicator: \"CryptAcquireContextW\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n file/memory contains long string with (Indicator: \"CryptGenRandom\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 41340; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 111447; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 156324; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 174478; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$35","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004824-00000C2C-2238314357\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found reference to API \"ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00004376.00000001.209954.11A62000.00000004.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004376.00000001.209954.11970000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004376.00000001.209954.11970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004824-00000C2C-2238314357\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.11B7F000.00000004.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"Connecting to momentum-effects-anderson-conferencing.trycloudflare.com:443\\formhistory.sqlite\" (Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{59CED\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90140000-002C-0409-1000-0000000FF1CE}r\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"Browsers/Chrome/Default/Cookies.txtCE}\" (Indicator: \"/cookies\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"Browsers/Edge/Default/Cookies.txt7968235\" (Indicator: \"/cookies\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"Path: C:\\Users\\HAPUBWS\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11970000.00000004.mdmp, 00000000-00004376.00000001.209954.119AD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"postmessage\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found reference to API \"parent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:\"\\/sadwfawx12\"}}),'https://web.telegram.org');}}catch(e){}\" (Indicator: \"postmessage\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found reference to API \"ConnectNamedPipeWARNINFO<\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeWCreateEventWCOOKIES:PASSWORDS:CARDS:IBANS:TOKENS:PROFILE:BLOB:\tBrowsers/\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetReadFile\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetSetOption\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"; curl fallback:\" (Indicator: \" curl \") in Source: 00000000-00004376.00000001.209954.80001000.00000020.mdmp\n Observed string: \"curl fallback: temp write:\" (Indicator: \"curl \") in Source: 00000000-00004376.00000001.209954.80001000.00000020.mdmp\n Observed string: \"curl fallback: spawn:\" (Indicator: \"curl \") in Source: 00000000-00004376.00000001.209954.80001000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$56","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetOpen\"; File: \"be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin\")\n Found reference to API \"InternetOpenWInternetConnectWHttpOpenRequestWHttpSendRequestWHttpQueryInfoWInternetQueryDataAvailableInternetReadFileInternetCloseHandleInternetSetOptionWHttpAddRequestHeadersW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004376.00000000.209197.19261000.00000020.mdmp, 00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"wlan show profiles\" (UID: 00000000-00004824)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\":\"https://www.mibbit.com/?url=%s\"}]},\"mailto\":{\"action\":4,\"handlers\":[null,{\"name\":\"yahoo! mail\",\"uritemplate\":\"https://compose.mail.yahoo.com/?\" [Source: 00000000-00004376.00000001.209954.11970000.00000004.mdmp], Observed email domain:\"**thorsten lorenz** <>\" [Source: 00000000-00004376.00000001.209954.11A62000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"64.124.12.162\" found in string \"/json/64.124.12.162\"\n \"64.124.12.162\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"64.124.12.162\" found in string \"GET http://ip-api.com/json/64.124.12.162 -> 200\"\n \"192.168.0.2\"\n \"255.255.255.0\"\n \"192.168.0.1\"\n \"255.255.255.255\"\n Potential IP \"64.124.12.162\" found in string \"#64.124.12.162\"\n Potential IP \"64.124.12.162\" found in string \"1777750057|INFO|WINHTTP|GET http://ip-api.com/json/64.124.12.162 -> 200||888627296\"\n Potential IP \"1.0.1.1\" found in string \".copilot.microsoft.com\tTRUE\t/\tTRUE\t13414428933979964\t__cf_bm\tLeayTAS2RYYyNDRDuVdY1qTSAMfGs.OxEzWdx18ndNU-1769953534-1.0.1.1-xosfQErdYeUsg4BohEV9KtokyOX0uZO1.Y4k.dENiemSIKqoZgCOV3cxQqCv7uCUuOhpqkxL7PRgm.5JEur7uS28qsHo914dPQxbcxXvDXA\"\n Potential IP \"32.0.0.101\" found in string \"32.0.0.101|$\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp\")\n Found string \"GET /sadwfawx12 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp\")\n Found string \"@HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found string \"GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004376.00000000.209197.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11490000.00000004.mdmp, 00000000-00004376.00000001.209954.11970000.00000004.mdmp, 00000000-00004376.00000001.209954.11A62000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"polygon-bor-rpc.publicnode.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.ipify.org\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://polygon-bor-rpc.publicnode.com/\n Found HTTPS GET request to https://t.me/sadwfawx12\n Found HTTPS GET request to https://momentum-effects-anderson-conferencing.trycloudflare.com/\n Found HTTPS GET request to https://momentum-effects-anderson-conferencing.trycloudflare.com/assets/cache/1a1afe4c-27ad-457c-8ee2-13ae6de5753e.png\n Found HTTPS GET request to https://api.ipify.org/\n Found HTTPS POST request to https://momentum-effects-anderson-conferencing.trycloudflare.com/api/log","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ipify.org\" (90 days old)\n Short term registered certificate: \"momentum-effects-anderson-conferencing.trycloudflare.com\" (90 days old)\n Short term registered certificate: \"polygon-bor-rpc.publicnode.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.20.24.117\" on port \"443\"\n HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"104.16.230.132\" on port \"443\"\n HTTPS traffic to \"104.26.13.205\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004376\"\n YARA signature for encryption algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"e,\"icon\":\"finger\" (Indicator: \"\"finger\") in Source: 00000000-00004376.00000001.209954.11970000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004376.00000000.209197.0F240000.00000004.mdmp, 00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap.\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found reference to API \"GetDesktopWindowGetDCGetSystemMetricsReleaseDC\" (Indicator: \"GetDC\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found reference to API \"GetDesktopWindowGetDCGetSystemMetricsReleaseDC\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found reference to API \"BitBltGetDIBits\" (Indicator: \"BitBlt\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")\n Found reference to API \"BitBltGetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"ONtQueryValueKey/\\2\" in \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\"\n Found registry query API: \"ZwOpenKeyZwOpenFileZwOpenProcessZwEnumerateKeyZwQueryValueKeyZwCreateThreadExZwTerminateProcessZwWriteVirtualMemoryZwProtectVirtualMemoryZwQueryInformationFileZwAllocateVirtualMemoryZwQuerySystemInformationZwClosez\" in \"00000000-00004376.00000001.209954.80001000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004376.00000001.209954.0F240000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationProcessTJ\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004376.00000001.209954.11490000.00000004.mdmp\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00004376.00000001.209954.11B7F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69f5ed984af34543e40dce00"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"