{ "type": "Domain", "indicator": "update.cat", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/update.cat", "alexa": "http://www.alexa.com/siteinfo/update.cat", "indicator": "update.cat", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3873823202, "indicator": "update.cat", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "69d3843cba399db62eeae702", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:28.397000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 509, "FileHash-SHA256": 539, "URL": 387, "hostname": 361, "domain": 100, "CIDR": 1, "email": 1 }, "indicator_count": 2679, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389d979acb0e20217e451", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:25.849000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 596, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389dab37e607e415f7304", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:26.731000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 596, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389db09844fda2dd3d26d", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:27.141000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 80, "domain": 17, "hostname": 59 }, "indicator_count": 600, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b4e828809a73c4baff9c5b", "name": "CAPE Sandbox terrible chain", "description": "", "modified": "2026-04-13T04:23:40.153000", "created": "2026-03-14T04:46:32.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b4e829e206f1e64d6fa31b", "name": "CAPE Sandbox terrible chain", "description": "", "modified": "2026-04-13T04:23:40.153000", "created": "2026-03-14T04:46:33.543000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b48ce44221764174cb6aab", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-12T22:04:09.704000", "created": "2026-03-13T22:17:07.826000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b48ce57b26a7b8bb9222b8", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-12T22:04:09.704000", "created": "2026-03-13T22:17:09.654000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c5d13d94af758096d048b9", "name": "Comprehensive Tria.ge import - Pro tip by Merkd1904 clone", "description": "", "modified": "2026-03-27T00:37:17.833000", "created": "2026-03-27T00:37:17.833000", "tags": [ "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "please", "javascript", "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "score", "behavioral task", "resource", "ck v13", "general", "target", "size", "sha256", "sha512", "ssdeep", "config", "copy", "shell", "sample", "sha1", "execution", "sample sample", "gpio promo", "sample gpio", "gpio2 driv", "sample gpio2", "target gpio", "adversaries", "bypass", "download submit", "filesize", "executes", "file", "download", "key value", "set value", "explorer", "class", "monitor", "signatures", "discovery", "iocs", "asusit885", "vendady", "venmsft", "proddadydvdrom4", "prodharddisk4", "drops file", "checks scsi", "processes", "network", "replay", "armourycra", "armoury crate", "token", "exe loads", "factory", "prefetch8", "service", "ck v6", "mitre", "f13eed8e", "suspicious use", "samsungma", "defense", "alderlakep", "alderlake", "sunrisepoi", "skylakesk", "tigerlakep", "reads cpu", "reads runtime", "tmpinxi", "ttps", "checks computer", "ngen worker", "process", "state migration", "installer", "binzsh c", "ksversion", "kschannelid", "apps", "plugins", "xpcproxy", "helper", "chrome helper", "renderer", "binlaunchctl", "data filesize", "error", "document being", "devnull md5", "play", "hypervisor", "mount o", "t iso9660", "f varlogmount", "analog", "triage submit", "static", "report analysis", "logs loading", "analysis log", "dos win95", "f win98", "f hpfs", "w95 f", "fat12 fat16", "extend", "setpasswd", "f root", "checks cpu", "discovery t1082", "managerwar", "wifinetwor", "query registry", "multimedia", "inprocserver32", "apartment", "typelib", "persistence", "progid", "nummethods", "10 discovery", "t1012 system", "appdir", "prefetch1", "registers com", "both", "chromehtml", "windowsdef", "enumerates", "systemroot", "windows media", "9801", "components", "checks", "localserver32", "open", "edit", "xport", "maxwellbio", "execution flow", "write file", "nvidialin", "excel", "sample https", "modifies", "fdoemcdcd", "klinks", "t1120 system", "windowstemp", "sample read", "traffic", "go play", "sample go", "cuckptn", "cuckicrc", "binsh c", "tags", "deviceinfo", "windowsinf", "targets", "ck matrix", "attempts", "m2 ssd", "p40 game", "filesintelintel", "legacy", "catalogfile", "pciven8086", "ndisasuss", "sample http", "microsoftw", "destination ip", "waasregke", "qeaa", "ueaa", "yaxxz", "iebapeadxz", "iebapeagxz", "headers dll", "lredmond", "locale", "suspicious", "player list", "sample bcd", "resources", "usrbinlogger t", "updater", "pid1522", "shadow copy", "dellsuppor", "landriver", "inputperso", "ipsmigrati", "sample intel", "servicingkey", "0008", "viper m2", "cannonlake", "cometlakep", "coffeelake", "cometlake", "10 blocklisted", "data", "supportass", "iocs reads", "APT1" ], "references": [ "imurmurhash.min.js", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/240317-kz93babd61", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230113-c79shshd41/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/240402-cb476add4w/behavioral2", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1qs1fafge3/behavioral25", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/231206-hvz1facd27/behavioral1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1130", "name": "Install Root Certificate", "display_name": "T1130 - Install Root Certificate" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1042", "name": "Change Default File Association", "display_name": "T1042 - Change Default File Association" } ], "industries": [], "TLP": "white", "cloned_from": "661c5aeb351e7ed1fd41dccd", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2817, "FileHash-SHA1": 2698, "FileHash-SHA256": 2703, "domain": 65, "URL": 12, "hostname": 13, "SSLCertFingerprint": 1 }, "indicator_count": 8309, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "66 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c5d13d5b19bfb5cf77057a", "name": "Comprehensive Tria.ge import - Pro tip by Merkd1904 clone", "description": "", "modified": "2026-03-27T00:37:17.317000", "created": "2026-03-27T00:37:17.317000", "tags": [ "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "please", "javascript", "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "score", "behavioral task", "resource", "ck v13", "general", "target", "size", "sha256", "sha512", "ssdeep", "config", "copy", "shell", "sample", "sha1", "execution", "sample sample", "gpio promo", "sample gpio", "gpio2 driv", "sample gpio2", "target gpio", "adversaries", "bypass", "download submit", "filesize", "executes", "file", "download", "key value", "set value", "explorer", "class", "monitor", "signatures", "discovery", "iocs", "asusit885", "vendady", "venmsft", "proddadydvdrom4", "prodharddisk4", "drops file", "checks scsi", "processes", "network", "replay", "armourycra", "armoury crate", "token", "exe loads", "factory", "prefetch8", "service", "ck v6", "mitre", "f13eed8e", "suspicious use", "samsungma", "defense", "alderlakep", "alderlake", "sunrisepoi", "skylakesk", "tigerlakep", "reads cpu", "reads runtime", "tmpinxi", "ttps", "checks computer", "ngen worker", "process", "state migration", "installer", "binzsh c", "ksversion", "kschannelid", "apps", "plugins", "xpcproxy", "helper", "chrome helper", "renderer", "binlaunchctl", "data filesize", "error", "document being", "devnull md5", "play", "hypervisor", "mount o", "t iso9660", "f varlogmount", "analog", "triage submit", "static", "report analysis", "logs loading", "analysis log", "dos win95", "f win98", "f hpfs", "w95 f", "fat12 fat16", "extend", "setpasswd", "f root", "checks cpu", "discovery t1082", "managerwar", "wifinetwor", "query registry", "multimedia", "inprocserver32", "apartment", "typelib", "persistence", "progid", "nummethods", "10 discovery", "t1012 system", "appdir", "prefetch1", "registers com", "both", "chromehtml", "windowsdef", "enumerates", "systemroot", "windows media", "9801", "components", "checks", "localserver32", "open", "edit", "xport", "maxwellbio", "execution flow", "write file", "nvidialin", "excel", "sample https", "modifies", "fdoemcdcd", "klinks", "t1120 system", "windowstemp", "sample read", "traffic", "go play", "sample go", "cuckptn", "cuckicrc", "binsh c", "tags", "deviceinfo", "windowsinf", "targets", "ck matrix", "attempts", "m2 ssd", "p40 game", "filesintelintel", "legacy", "catalogfile", "pciven8086", "ndisasuss", "sample http", "microsoftw", "destination ip", "waasregke", "qeaa", "ueaa", "yaxxz", "iebapeadxz", "iebapeagxz", "headers dll", "lredmond", "locale", "suspicious", "player list", "sample bcd", "resources", "usrbinlogger t", "updater", "pid1522", "shadow copy", "dellsuppor", "landriver", "inputperso", "ipsmigrati", "sample intel", "servicingkey", "0008", "viper m2", "cannonlake", "cometlakep", "coffeelake", "cometlake", "10 blocklisted", "data", "supportass", "iocs reads", "APT1" ], "references": [ "imurmurhash.min.js", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/240317-kz93babd61", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230113-c79shshd41/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/240402-cb476add4w/behavioral2", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1qs1fafge3/behavioral25", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/231206-hvz1facd27/behavioral1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1130", "name": "Install Root Certificate", "display_name": "T1130 - Install Root Certificate" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1042", "name": "Change Default File Association", "display_name": "T1042 - Change Default File Association" } ], "industries": [], "TLP": "white", "cloned_from": "661c5aeb351e7ed1fd41dccd", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2817, "FileHash-SHA1": 2698, "FileHash-SHA256": 2703, "domain": 65, "URL": 12, "hostname": 13, "SSLCertFingerprint": 1 }, "indicator_count": 8309, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "66 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "661c5aeb351e7ed1fd41dccd", "name": "Comprehensive Tria.ge import - Pro tip", "description": "You have to upload the specific behavior page to import IoC's outside of the static analysis. It's also important to note that over the course of the last six months the anti-VM and anti-sandbox and anti-debug capabilities got noticably better. This is only analysis that got a 6+ threat score. Not the countless files that did not run.", "modified": "2024-05-14T21:00:00.653000", "created": "2024-04-14T22:38:35.008000", "tags": [ "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "please", "javascript", "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "score", "behavioral task", "resource", "ck v13", "general", "target", "size", "sha256", "sha512", "ssdeep", "config", "copy", "shell", "sample", "sha1", "execution", "sample sample", "gpio promo", "sample gpio", "gpio2 driv", "sample gpio2", "target gpio", "adversaries", "bypass", "download submit", "filesize", "executes", "file", "download", "key value", "set value", "explorer", "class", "monitor", "signatures", "discovery", "iocs", "asusit885", "vendady", "venmsft", "proddadydvdrom4", "prodharddisk4", "drops file", "checks scsi", "processes", "network", "replay", "armourycra", "armoury crate", "token", "exe loads", "factory", "prefetch8", "service", "ck v6", "mitre", "f13eed8e", "suspicious use", "samsungma", "defense", "alderlakep", "alderlake", "sunrisepoi", "skylakesk", "tigerlakep", "reads cpu", "reads runtime", "tmpinxi", "ttps", "checks computer", "ngen worker", "process", "state migration", "installer", "binzsh c", "ksversion", "kschannelid", "apps", "plugins", "xpcproxy", "helper", "chrome helper", "renderer", "binlaunchctl", "data filesize", "error", "document being", "devnull md5", "play", "hypervisor", "mount o", "t iso9660", "f varlogmount", "analog", "triage submit", "static", "report analysis", "logs loading", "analysis log", "dos win95", "f win98", "f hpfs", "w95 f", "fat12 fat16", "extend", "setpasswd", "f root", "checks cpu", "discovery t1082", "managerwar", "wifinetwor", "query registry", "multimedia", "inprocserver32", "apartment", "typelib", "persistence", "progid", "nummethods", "10 discovery", "t1012 system", "appdir", "prefetch1", "registers com", "both", "chromehtml", "windowsdef", "enumerates", "systemroot", "windows media", "9801", "components", "checks", "localserver32", "open", "edit", "xport", "maxwellbio", "execution flow", "write file", "nvidialin", "excel", "sample https", "modifies", "fdoemcdcd", "klinks", "t1120 system", "windowstemp", "sample read", "traffic", "go play", "sample go", "cuckptn", "cuckicrc", "binsh c", "tags", "deviceinfo", "windowsinf", "targets", "ck matrix", "attempts", "m2 ssd", "p40 game", "filesintelintel", "legacy", "catalogfile", "pciven8086", "ndisasuss", "sample http", "microsoftw", "destination ip", "waasregke", "qeaa", "ueaa", "yaxxz", "iebapeadxz", "iebapeagxz", "headers dll", "lredmond", "locale", "suspicious", "player list", "sample bcd", "resources", "usrbinlogger t", "updater", "pid1522", "shadow copy", "dellsuppor", "landriver", "inputperso", "ipsmigrati", "sample intel", "servicingkey", "0008", "viper m2", "cannonlake", "cometlakep", "coffeelake", "cometlake", "10 blocklisted", "data", "supportass", "iocs reads", "APT1" ], "references": [ "imurmurhash.min.js", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/240317-kz93babd61", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230113-c79shshd41/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/240402-cb476add4w/behavioral2", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1qs1fafge3/behavioral25", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/231206-hvz1facd27/behavioral1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1130", "name": "Install Root Certificate", "display_name": "T1130 - Install Root Certificate" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1042", "name": "Change Default File Association", "display_name": "T1042 - Change Default File Association" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Merkd1904", "id": "196517", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2817, "FileHash-SHA1": 2698, "FileHash-SHA256": 2703, "domain": 65, "URL": 12, "hostname": 13, "SSLCertFingerprint": 1 }, "indicator_count": 8309, "is_author": false, "is_subscribing": null, "subscriber_count": 76, "modified_text": "747 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/231206-hvz1facd27/behavioral1", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "imurmurhash.min.js", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/230113-c79shshd41/behavioral2", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/240317-kz93babd61", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/240402-cb476add4w/behavioral2", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral25" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "69d3843cba399db62eeae702", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:28.397000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 509, "FileHash-SHA256": 539, "URL": 387, "hostname": 361, "domain": 100, "CIDR": 1, "email": 1 }, "indicator_count": 2679, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389d979acb0e20217e451", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:25.849000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 596, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389dab37e607e415f7304", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:26.731000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 596, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d389db09844fda2dd3d26d", "name": "CAPE Sandbox", "description": "", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:24:27.141000", "tags": [ "p2404", "strong", "sha256", "library", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "none rticon", "info", "path", "win32", "accept", "null", "activator", "false", "black", "powershell", "error", "team", "code", "date", "download", "stop", "green", "class", "void", "cheap", "shutdown", "impact", "guard", "tools", "comspec", "enterprise", "terminal", "music", "desktop", "crypt32", "lockfile", "write", "open", "stub", "delta", "title", "body", "project", "windows sandbox", "calls process" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/f65b955b42f6834de9bd8b084cdab903144a4ddaf38222a1408b4dda59fc3c25_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471046&Signature=m8P0sVa9IvW1ZUOv%2BlJipa01bT4c79dbjaPj0vJUplT1orO5ImM8ekzIM2p0n75b9OEnqifkI5qLdfWrbmw1MrpBdv2Hs%2FONRoVZLAcoIvGCFqtOm1ICKHXI7AQepGbQIIKcchoCtZCxiNmnqeLqW7rvtLrzc7vMo1bjRvzVK03X83b1Ap5vCgvQmNvbBgeaA9McOs4JBMiOjb2%2FtrBU0yB4aY1eKvhfKIsVis5sY90Ljch5h8umrIYl", "https://vtbehaviour.commondatastorage.googleapis.com/04debe133ee8e0c49579e2cc84b9ddae38a9ada8d5e64409055573f59f8b374d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775471300&Signature=llYVmKPsFPumnoaQibMHdribcji6%2FleUI8SnqlNHmcEnMAkiee7AsqjLt4hAuJ2ohPNbUL3Pcp%2FdiSxG0ou5IxM59BKrDeFqeHfJga%2BFZPNwU9puoAbZeeNlEaDuk76OjORjSNUMwTg3Z%2Fqq5grDxUUbQ7tO6Yvc58%2FJ26Mbgh2DSdT8qT6wcBZD9RUcie7RY5wMC1TDAalZdS5wiqTw1I412KZa0Ka9Q8pN0jBXaionvI" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 172, "FileHash-SHA1": 151, "FileHash-SHA256": 121, "URL": 80, "domain": 17, "hostname": 59 }, "indicator_count": 600, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "26 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b4e828809a73c4baff9c5b", "name": "CAPE Sandbox terrible chain", "description": "", "modified": "2026-04-13T04:23:40.153000", "created": "2026-03-14T04:46:32.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b4e829e206f1e64d6fa31b", "name": "CAPE Sandbox terrible chain", "description": "", "modified": "2026-04-13T04:23:40.153000", "created": "2026-03-14T04:46:33.543000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b48ce44221764174cb6aab", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-12T22:04:09.704000", "created": "2026-03-13T22:17:07.826000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b48ce57b26a7b8bb9222b8", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-12T22:04:09.704000", "created": "2026-03-13T22:17:09.654000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 173, "FileHash-SHA1": 150, "FileHash-SHA256": 123, "URL": 78, "domain": 15, "hostname": 59 }, "indicator_count": 598, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c5d13d94af758096d048b9", "name": "Comprehensive Tria.ge import - Pro tip by Merkd1904 clone", "description": "", "modified": "2026-03-27T00:37:17.833000", "created": "2026-03-27T00:37:17.833000", "tags": [ "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "please", "javascript", "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "score", "behavioral task", "resource", "ck v13", "general", "target", "size", "sha256", "sha512", "ssdeep", "config", "copy", "shell", "sample", "sha1", "execution", "sample sample", "gpio promo", "sample gpio", "gpio2 driv", "sample gpio2", "target gpio", "adversaries", "bypass", "download submit", "filesize", "executes", "file", "download", "key value", "set value", "explorer", "class", "monitor", "signatures", "discovery", "iocs", "asusit885", "vendady", "venmsft", "proddadydvdrom4", "prodharddisk4", "drops file", "checks scsi", "processes", "network", "replay", "armourycra", "armoury crate", "token", "exe loads", "factory", "prefetch8", "service", "ck v6", "mitre", "f13eed8e", "suspicious use", "samsungma", "defense", "alderlakep", "alderlake", "sunrisepoi", "skylakesk", "tigerlakep", "reads cpu", "reads runtime", "tmpinxi", "ttps", "checks computer", "ngen worker", "process", "state migration", "installer", "binzsh c", "ksversion", "kschannelid", "apps", "plugins", "xpcproxy", "helper", "chrome helper", "renderer", "binlaunchctl", "data filesize", "error", "document being", "devnull md5", "play", "hypervisor", "mount o", "t iso9660", "f varlogmount", "analog", "triage submit", "static", "report analysis", "logs loading", "analysis log", "dos win95", "f win98", "f hpfs", "w95 f", "fat12 fat16", "extend", "setpasswd", "f root", "checks cpu", "discovery t1082", "managerwar", "wifinetwor", "query registry", "multimedia", "inprocserver32", "apartment", "typelib", "persistence", "progid", "nummethods", "10 discovery", "t1012 system", "appdir", "prefetch1", "registers com", "both", "chromehtml", "windowsdef", "enumerates", "systemroot", "windows media", "9801", "components", "checks", "localserver32", "open", "edit", "xport", "maxwellbio", "execution flow", "write file", "nvidialin", "excel", "sample https", "modifies", "fdoemcdcd", "klinks", "t1120 system", "windowstemp", "sample read", "traffic", "go play", "sample go", "cuckptn", "cuckicrc", "binsh c", "tags", "deviceinfo", "windowsinf", "targets", "ck matrix", "attempts", "m2 ssd", "p40 game", "filesintelintel", "legacy", "catalogfile", "pciven8086", "ndisasuss", "sample http", "microsoftw", "destination ip", "waasregke", "qeaa", "ueaa", "yaxxz", "iebapeadxz", "iebapeagxz", "headers dll", "lredmond", "locale", "suspicious", "player list", "sample bcd", "resources", "usrbinlogger t", "updater", "pid1522", "shadow copy", "dellsuppor", "landriver", "inputperso", "ipsmigrati", "sample intel", "servicingkey", "0008", "viper m2", "cannonlake", "cometlakep", "coffeelake", "cometlake", "10 blocklisted", "data", "supportass", "iocs reads", "APT1" ], "references": [ "imurmurhash.min.js", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/240317-kz93babd61", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230113-c79shshd41/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/240402-cb476add4w/behavioral2", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1qs1fafge3/behavioral25", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/231206-hvz1facd27/behavioral1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1130", "name": "Install Root Certificate", "display_name": "T1130 - Install Root Certificate" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1042", "name": "Change Default File Association", "display_name": "T1042 - Change Default File Association" } ], "industries": [], "TLP": "white", "cloned_from": "661c5aeb351e7ed1fd41dccd", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2817, "FileHash-SHA1": 2698, "FileHash-SHA256": 2703, "domain": 65, "URL": 12, "hostname": 13, "SSLCertFingerprint": 1 }, "indicator_count": 8309, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "66 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c5d13d5b19bfb5cf77057a", "name": "Comprehensive Tria.ge import - Pro tip by Merkd1904 clone", "description": "", "modified": "2026-03-27T00:37:17.317000", "created": "2026-03-27T00:37:17.317000", "tags": [ "implementation", "murmurhash3", "jens taylor", "gary court", "austin appleby", "typeof h", "please", "javascript", "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "score", "behavioral task", "resource", "ck v13", "general", "target", "size", "sha256", "sha512", "ssdeep", "config", "copy", "shell", "sample", "sha1", "execution", "sample sample", "gpio promo", "sample gpio", "gpio2 driv", "sample gpio2", "target gpio", "adversaries", "bypass", "download submit", "filesize", "executes", "file", "download", "key value", "set value", "explorer", "class", "monitor", "signatures", "discovery", "iocs", "asusit885", "vendady", "venmsft", "proddadydvdrom4", "prodharddisk4", "drops file", "checks scsi", "processes", "network", "replay", "armourycra", "armoury crate", "token", "exe loads", "factory", "prefetch8", "service", "ck v6", "mitre", "f13eed8e", "suspicious use", "samsungma", "defense", "alderlakep", "alderlake", "sunrisepoi", "skylakesk", "tigerlakep", "reads cpu", "reads runtime", "tmpinxi", "ttps", "checks computer", "ngen worker", "process", "state migration", "installer", "binzsh c", "ksversion", "kschannelid", "apps", "plugins", "xpcproxy", "helper", "chrome helper", "renderer", "binlaunchctl", "data filesize", "error", "document being", "devnull md5", "play", "hypervisor", "mount o", "t iso9660", "f varlogmount", "analog", "triage submit", "static", "report analysis", "logs loading", "analysis log", "dos win95", "f win98", "f hpfs", "w95 f", "fat12 fat16", "extend", "setpasswd", "f root", "checks cpu", "discovery t1082", "managerwar", "wifinetwor", "query registry", "multimedia", "inprocserver32", "apartment", "typelib", "persistence", "progid", "nummethods", "10 discovery", "t1012 system", "appdir", "prefetch1", "registers com", "both", "chromehtml", "windowsdef", "enumerates", "systemroot", "windows media", "9801", "components", "checks", "localserver32", "open", "edit", "xport", "maxwellbio", "execution flow", "write file", "nvidialin", "excel", "sample https", "modifies", "fdoemcdcd", "klinks", "t1120 system", "windowstemp", "sample read", "traffic", "go play", "sample go", "cuckptn", "cuckicrc", "binsh c", "tags", "deviceinfo", "windowsinf", "targets", "ck matrix", "attempts", "m2 ssd", "p40 game", "filesintelintel", "legacy", "catalogfile", "pciven8086", "ndisasuss", "sample http", "microsoftw", "destination ip", "waasregke", "qeaa", "ueaa", "yaxxz", "iebapeadxz", "iebapeagxz", "headers dll", "lredmond", "locale", "suspicious", "player list", "sample bcd", "resources", "usrbinlogger t", "updater", "pid1522", "shadow copy", "dellsuppor", "landriver", "inputperso", "ipsmigrati", "sample intel", "servicingkey", "0008", "viper m2", "cannonlake", "cometlakep", "coffeelake", "cometlake", "10 blocklisted", "data", "supportass", "iocs reads", "APT1" ], "references": [ "imurmurhash.min.js", "https://www.virustotal.com/gui/file/e58fe1f551a6fb3e0a8bbaed5f8cae96194ccbbba5f4da2914a5046a4df3725e?nocache=1", "https://www.virustotal.com/gui/file/03759f9a14c983a9e70d17d0552fb2bff9dc1fe8c9b837f859403449ecdadd11?nocache=1", "https://www.virustotal.com/gui/file/32dbd62fce658336afc05435cafed68029dba626e5863a39305eaf8f42ed74cd?nocache=1", "https://www.virustotal.com/gui/file/049645f56e88a33c0d5d74b5ad9dc7da425a326ee72db4885b712c16f9edeb54?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd?nocache=1", "https://www.virustotal.com/gui/file/b9cee56cd245633f7debe4b6e93f1606ac6788a9749a8eba2d742cfd84e935fd", "https://www.virustotal.com/gui/file/8694bebdcbe7854aae97fcecfce0fa0b5a9aa07b5f95cd2e55d62a25caaaa8d8?nocache=1", "https://www.virustotal.com/gui/file/b2b37af320b637acc1001404b6a7f9bbfc4dcfb7319bba92333be2050b398318/relations", "https://tria.ge/231217-yjcc1afeap", "https://tria.ge/231217-yl3mzafebp", "https://tria.ge/231217-yscecsfefl", "https://tria.ge/231217-ysjtfahaf3", "https://tria.ge/231217-zztgwsfger", "https://tria.ge/231224-g5gq6sbhb2", "https://tria.ge/231224-3h4hbaefg7", "https://tria.ge/240106-dbq6zafccm", "https://tria.ge/240107-eq4w2sfch5", "https://tria.ge/240111-cahyjaccem", "https://tria.ge/240129-lkztgaehh2", "https://tria.ge/240129-m661cagdb6", "https://tria.ge/240317-kz93babd61", "https://tria.ge/240317-kz93babd61/behavioral2", "https://tria.ge/240410-aceyjseb6v/behavioral4", "https://tria.ge/230108-ftrlkagb7z/behavioral1", "https://tria.ge/230108-ftyd4sgb71/behavioral10", "https://tria.ge/230108-fvadnsgb8s/behavioral27", "https://tria.ge/230108-qrmvpsdf96/behavioral3", "https://tria.ge/230108-qrv63sdf97/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral2", "https://tria.ge/230108-qr6b2sdg22/behavioral3", "https://tria.ge/230108-qsdneshb2w/behavioral10", "https://tria.ge/230113-ctz16adf45/behavioral1", "https://tria.ge/230113-c3xbmadf82/behavioral2", "https://tria.ge/230113-c79shshd41/behavioral2", "https://tria.ge/230108-qvj8zshb3t/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral27", "https://tria.ge/230113-dbgbrshd61/behavioral5", "https://tria.ge/230113-dfhemadg66/behavioral7", "https://tria.ge/231015-l3gqlsdg6w/behavioral11", "https://tria.ge/230906-vajh6shg63/behavioral3", "https://tria.ge/230901-qkt1faeh2v/behavioral3", "https://tria.ge/231128-vbn52sbf51/behavioral7", "https://tria.ge/231206-gkeq3sbg68/behavioral7", "https://tria.ge/231206-hf1cnacb98/behavioral7", "https://tria.ge/240409-25x4dagh63/behavioral4", "https://tria.ge/240409-dhdjfsce54/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral28", "https://tria.ge/240402-zjrcladb42/behavioral27", "https://tria.ge/240402-zjrcladb42/behavioral1", "https://tria.ge/240402-zjrcladb42/behavioral2", "https://tria.ge/240402-zjrcladb42/behavioral3", "https://tria.ge/240402-zjrcladb42/behavioral4", "https://tria.ge/240402-zjrcladb42/behavioral5", "https://tria.ge/240402-zjrcladb42/behavioral6", "https://tria.ge/240402-zjrcladb42/behavioral9", "https://tria.ge/240402-zjrcladb42/behavioral13", "https://tria.ge/240402-zjrcladb42/behavioral13/analog", "https://tria.ge/240402-zjrcladb42/behavioral17", "https://tria.ge/240402-zjrcladb42/behavioral21", "https://tria.ge/240402-zjrcladb42/behavioral25", "https://tria.ge/240402-zjrcladb42/behavioral29", "https://tria.ge/240402-cb476add4w/behavioral2", "https://tria.ge/240401-b3bt9aad37/behavioral11", "https://tria.ge/240401-bztwnaac57/behavioral2", "https://tria.ge/240331-y9w54abd6t/behavioral7", "https://tria.ge/240331-yqk9gsaf9z/behavioral10", "https://tria.ge/240331-ykp1gsae3z/behavioral28", "https://tria.ge/240331-ykp1gsae3z/behavioral20", "https://tria.ge/240331-ykp1gsae3z/behavioral14", "https://tria.ge/240331-ykp1gsae3z/behavioral12", "https://tria.ge/240331-ykp1gsae3z/behavioral4", "https://tria.ge/240331-ykp1gsae3z/behavioral2", "https://tria.ge/220803-zggqdafbh7/behavioral2", "https://tria.ge/220803-y7119sgafr/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral28", "https://tria.ge/220803-y6bpzsfag2/behavioral26", "https://tria.ge/220803-y6bpzsfag2/behavioral22", "https://tria.ge/220803-y6bpzsfag2/behavioral20", "https://tria.ge/220803-y6bpzsfag2/behavioral18", "https://tria.ge/220803-y6bpzsfag2/behavioral16", "https://tria.ge/220803-y6bpzsfag2/behavioral12", "https://tria.ge/220803-y6bpzsfag2/behavioral10", "https://tria.ge/220803-1m2heafgb9/behavioral13", "https://tria.ge/220803-1m2heafgb9/behavioral8", "https://tria.ge/220803-1m4yjafgc2/behavioral31", "https://tria.ge/220803-1m4yjafgc2/behavioral29", "https://tria.ge/220803-1m4yjafgc2/behavioral27", "https://tria.ge/220803-1m4yjafgc2/behavioral25", "https://tria.ge/220803-1m4yjafgc2/behavioral23", "https://tria.ge/220803-1m4yjafgc2/behavioral22", "https://tria.ge/220803-1m4yjafgc2/behavioral19", "https://tria.ge/220803-1m4yjafgc2/behavioral17", "https://tria.ge/220803-1m4yjafgc2/behavioral15", "https://tria.ge/220803-1m4yjafgc2/behavioral13", "https://tria.ge/220803-1m4yjafgc2/behavioral9", "https://tria.ge/220803-1m4yjafgc2/behavioral7", "https://tria.ge/220803-1m4yjafgc2/behavioral6", "https://tria.ge/220803-1m4yjafgc2/behavioral5", "https://tria.ge/220803-1m4yjafgc2/behavioral3", "https://tria.ge/220803-1m4yjafgc2/behavioral2", "https://tria.ge/220803-1m4yjafgc2/behavioral1", "https://tria.ge/220803-1nlhksfgc3/behavioral32", "https://tria.ge/220803-1nlhksfgc3/behavioral1", "https://tria.ge/220803-1pfnqagffp/behavioral32", "https://tria.ge/220803-1pfnqagffp/behavioral4", "https://tria.ge/220803-1qd7aafgd9/behavioral28", "https://tria.ge/220803-1qd7aafgd9/behavioral24", "https://tria.ge/220803-1qd7aafgd9/behavioral23", "https://tria.ge/220803-1qd7aafgd9/behavioral22", "https://tria.ge/220803-1qd7aafgd9/behavioral21", "https://tria.ge/220803-1qd7aafgd9/behavioral15", "https://tria.ge/220803-1qs1fafge3/behavioral29", "https://tria.ge/220803-1qs1fafge3/behavioral27", "https://tria.ge/220803-1qs1fafge3/behavioral25", "https://tria.ge/220803-1qs1fafge3/behavioral23", "https://tria.ge/220803-1qs1fafge3/behavioral22", "https://tria.ge/220803-1qs1fafge3/behavioral19", "https://tria.ge/220803-1qs1fafge3/behavioral17", "https://tria.ge/220803-1qs1fafge3/behavioral13", "https://tria.ge/220803-1qs1fafge3/behavioral9", "https://tria.ge/220803-1qs1fafge3/behavioral6", "https://tria.ge/220803-1qs1fafge3/behavioral5", "https://tria.ge/220803-1qs1fafge3/behavioral1", "https://tria.ge/220803-1qs1fafge3/behavioral2", "https://tria.ge/220803-1qs1fafge3/behavioral3", "https://tria.ge/220803-1rxd9afgf2/behavioral28", "https://tria.ge/220803-1rxd9afgf2/behavioral27", "https://tria.ge/220803-1rxd9afgf2/behavioral23", "https://tria.ge/220803-1rxd9afgf2/behavioral19", "https://tria.ge/220803-1rxd9afgf2/behavioral15", "https://tria.ge/220804-cb7naaafeq", "https://tria.ge/220804-cb7naaafeq/behavioral1", "https://tria.ge/220805-fqatmsgbdr/behavioral3", "https://tria.ge/220805-fqkzlsfcb6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral1", "https://tria.ge/220805-ft3zlafce6/behavioral3", "https://tria.ge/220805-ft3zlafce6/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral3", "https://tria.ge/220805-fwthyagcbq/behavioral2", "https://tria.ge/220805-fwthyagcbq/behavioral1", "https://tria.ge/220805-f286ksfdc7", "https://tria.ge/220805-f286ksfdc7/behavioral3", "https://tria.ge/220805-gca3xsgeaj/behavioral2", "https://tria.ge/220805-gca3xsgeaj/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral3", "https://tria.ge/220805-gv8rxafgf8/behavioral1", "https://tria.ge/220805-h1w6qshdaq/behavioral3", "https://tria.ge/220805-h1w6qshdaq/behavioral2", "https://tria.ge/220805-h1w6qshdaq/behavioral1", "https://tria.ge/220805-yv476aggd6/behavioral3", "https://tria.ge/220805-yv476aggd6/behavioral2", "https://tria.ge/220805-zetbdshag5/behavioral3", "https://tria.ge/220805-zetbdshag5/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral1", "https://tria.ge/220806-brndxabdh6/behavioral2", "https://tria.ge/220806-brndxabdh6/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral3", "https://tria.ge/220806-btaktsbea5/behavioral2", "https://tria.ge/220806-btaktsbea5/behavioral1", "https://tria.ge/220806-jrkl1sccfl", "https://tria.ge/220806-jrkl1sccfl/behavioral3", "https://tria.ge/220806-jrkl1sccfl/behavioral2", "https://tria.ge/220806-jrkl1sccfl/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral1", "https://tria.ge/220806-j2ztpaceak/behavioral3", "https://tria.ge/220806-j3912scebk/behavioral3", "https://tria.ge/220806-j4w6ksfab3/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral3", "https://tria.ge/220830-17kqdsdfb2/behavioral2", "https://tria.ge/220830-17kqdsdfb2/behavioral1", "https://tria.ge/220729-d8e5zadga9/behavioral2", "https://tria.ge/220729-d8av9adga3/behavioral2", "https://tria.ge/220729-d74f6seedk/behavioral2", "https://tria.ge/220729-d7ta7sdfh9/behavioral2", "https://tria.ge/220729-d347xadfe7/behavioral2", "https://tria.ge/220729-d3yecseeam/behavioral2", "https://tria.ge/220729-d3sh4seeal/behavioral2", "https://tria.ge/220729-d3m9dsdfe3/behavioral2", "https://tria.ge/220729-d3dd7aedhk/behavioral2", "https://tria.ge/220729-d2kf4sedgl/behavioral2", "https://tria.ge/220729-d1hwwsdfc7/behavioral2", "https://tria.ge/220729-d85evsdgb3/behavioral2", "https://tria.ge/220729-ecv2zsdgd7/behavioral2", "https://tria.ge/220729-ecnb5sdgd5/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral2", "https://tria.ge/220729-wzxyjacgal/behavioral1", "https://tria.ge/220729-w1gmyabhf2/behavioral2", "https://tria.ge/220729-24hbjaeeep/behavioral1", "https://tria.ge/220730-chkgbsehh6/behavioral2", "https://tria.ge/220731-f45wyabgbr/behavioral3", "https://tria.ge/220801-sppmmaafd6/behavioral28", "https://tria.ge/220801-sppmmaafd6/behavioral20", "https://tria.ge/220801-sppmmaafd6/behavioral19", "https://tria.ge/220802-kwqt9secdp", "https://tria.ge/220802-kwqt9secdp/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral1", "https://tria.ge/220803-yl8h8afgdn/behavioral12", "https://tria.ge/220803-yl8h8afgdn/behavioral8", "https://tria.ge/220803-yl8h8afgdn/behavioral7", "https://tria.ge/220803-yl8h8afgdn/behavioral4", "https://tria.ge/220803-yl8h8afgdn/behavioral3", "https://tria.ge/220803-ymle3sfgdp/behavioral6", "https://tria.ge/220803-ymle3sfgdp/behavioral28", "https://tria.ge/220803-ymle3sfgdp/behavioral27", "https://tria.ge/220803-ymle3sfgdp/behavioral23", "https://tria.ge/220803-ymle3sfgdp/behavioral19", "https://tria.ge/220803-ymle3sfgdp/behavioral15", "https://tria.ge/220803-yshldaehd8/behavioral14", "https://tria.ge/220803-yshldaehd8/behavioral13", "https://tria.ge/220803-yshldaehd8/behavioral3", "https://tria.ge/220726-xskv3addar/behavioral2", "https://tria.ge/220726-xskv3addar/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral1", "https://tria.ge/220726-xz7y6sddgk/behavioral4", "https://tria.ge/220726-xz7y6sddgk/behavioral3", "https://tria.ge/220726-xz7y6sddgk/behavioral2", "https://tria.ge/220726-x1m1dsddgl/behavioral1", "https://tria.ge/220726-x1m1dsddgl/behavioral4", "https://tria.ge/220726-x1m1dsddgl/behavioral3", "https://tria.ge/220726-x1m1dsddgl/behavioral2", "https://tria.ge/220727-bv535aghfl/behavioral8", "https://tria.ge/220727-bv535aghfl/behavioral7", "https://tria.ge/220727-bv535aghfl/behavioral1", "https://tria.ge/220729-dqk89secfn/behavioral1", "https://tria.ge/220729-dqgwvaecfm/behavioral1", "https://tria.ge/220724-rl2mcafdbm/behavioral1", "https://tria.ge/220724-rtnqfsfeg6/behavioral1", "https://tria.ge/220724-sheh3sgddl/behavioral1", "https://tria.ge/220724-slp4zsgdh2/behavioral1", "https://tria.ge/220724-tacvysheh8/behavioral7", "https://tria.ge/220724-tetn9shgf9", "https://tria.ge/220724-tmtn8sacej/behavioral1", "https://tria.ge/220724-tmtn8sacej/behavioral26", "https://tria.ge/220724-tmtn8sacej/behavioral25", "https://tria.ge/220724-tmtn8sacej/behavioral15", "https://tria.ge/220724-fgjeesffc7/behavioral1", "https://tria.ge/220724-fgjeesffc7/behavioral2", "https://tria.ge/220916-d8f29seef7/behavioral2", "https://tria.ge/220912-r4wh2shccm", "https://tria.ge/220912-r4wh2shccm/behavioral1", "https://tria.ge/220912-r4fsladea8/behavioral1", "https://tria.ge/220912-r36ydsdea7/behavioral2", "https://tria.ge/220912-r3z5vahccj/behavioral2", "https://tria.ge/220912-r25nyahcbp/behavioral2", "https://tria.ge/220912-r2sdlshcbn/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral2", "https://tria.ge/220912-r2j28sdea3/behavioral1", "https://tria.ge/220912-r2dkfsdea2/behavioral2", "https://tria.ge/220912-r16vlsddh9/behavioral2", "https://tria.ge/220912-rxnvmaddh6/behavioral2", "https://tria.ge/220912-rxb6tsddh5/behavioral2", "https://tria.ge/220912-rtwfashcaq/behavioral2", "https://tria.ge/220912-rtf1lsddg8", "https://tria.ge/220912-rsreyshcam/behavioral2", "https://tria.ge/220912-rsc8bsddg6/behavioral3", "https://tria.ge/220912-rqlrpahbhr/behavioral2", "https://tria.ge/220912-rp93wshbhq/behavioral2", "https://tria.ge/220912-rpzxxshbhp/behavioral2", "https://tria.ge/220912-rpjkyaddf9/behavioral3", "https://tria.ge/220912-rn3meshbhl/behavioral2", "https://tria.ge/220912-regnladdd6/behavioral3", "https://tria.ge/220930-vmljasfbcm/behavioral2", "https://tria.ge/220930-vmv3qsfbcn/behavioral2", "https://tria.ge/221007-2b72gsdga7/behavioral32", "https://tria.ge/221007-2b72gsdga7/behavioral26", "https://tria.ge/221007-2b72gsdga7/behavioral25", "https://tria.ge/221007-2b72gsdga7/behavioral20", "https://tria.ge/221007-2b72gsdga7/behavioral19", "https://tria.ge/221007-2b72gsdga7/behavioral16", "https://tria.ge/221007-2b72gsdga7/behavioral15", "https://tria.ge/221012-bm6ppacbam/behavioral3", "https://tria.ge/221012-bm6ppacbam/behavioral14", "https://tria.ge/221012-bm6ppacbam/behavioral12", "https://tria.ge/221014-2dbfasegfn/behavioral3", "https://tria.ge/221015-rqzcsaffhq/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral2", "https://tria.ge/221202-wskpmaeg7x/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral1", "https://tria.ge/221205-jd6bkada9w/behavioral2", "https://tria.ge/221212-j9yxcsdf2z/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral3", "https://tria.ge/221212-kcchjaah54/behavioral2", "https://tria.ge/221212-kcchjaah54/behavioral1", "https://tria.ge/221212-kdv19sdf3t/behavioral32", "https://tria.ge/221212-kdv19sdf3t/behavioral2", "https://tria.ge/221212-kd3q4sah55/behavioral3", "https://tria.ge/221215-sqzh8acf73/behavioral1", "https://tria.ge/221215-ta2t3sff7y/behavioral4", "https://tria.ge/221220-y6pa3seb4w/behavioral2", "https://tria.ge/221221-h9mcwsbg93/behavioral1", "https://tria.ge/221221-h9mcwsbg93/behavioral32", "https://tria.ge/221221-h9mcwsbg93/behavioral26", "https://tria.ge/221221-h9mcwsbg93/behavioral2", "https://tria.ge/221015-tfg2vsfge9/behavioral1", "https://tria.ge/221015-tfg2vsfge9/behavioral3", "https://tria.ge/221015-tfg2vsfge9/behavioral2", "https://tria.ge/221015-tlpznafgf6/behavioral1", "https://tria.ge/221015-tlpznafgf6/behavioral2", "https://tria.ge/221015-tl29zsfgf8/behavioral1", "https://tria.ge/221015-tl29zsfgf8/behavioral2", "https://tria.ge/221015-tlxz9sfgf7/behavioral1", "https://tria.ge/221015-tlxz9sfgf7/behavioral2", "https://tria.ge/221017-2zl4xsdec9/behavioral31", "https://tria.ge/221017-2zl4xsdec9/behavioral29", "https://tria.ge/221017-2zl4xsdec9/behavioral25", "https://tria.ge/221017-2zl4xsdec9/behavioral21", "https://tria.ge/221017-2zl4xsdec9/behavioral18", "https://tria.ge/221017-2zl4xsdec9/behavioral17", "https://tria.ge/221017-2zl4xsdec9/behavioral9", "https://tria.ge/221017-2zl4xsdec9/behavioral14", "https://tria.ge/221025-gp398sbfhp/behavioral15", "https://tria.ge/221025-gp398sbfhp/behavioral9", "https://tria.ge/221025-gp398sbfhp/behavioral8", "https://tria.ge/221025-gp398sbfhp/behavioral7", "https://tria.ge/221025-gp398sbfhp/behavioral6", "https://tria.ge/221025-gp398sbfhp/behavioral5", "https://tria.ge/221025-gp398sbfhp/behavioral4", "https://tria.ge/221025-gqnwyabfh3/behavioral1", "https://tria.ge/221025-gqnwyabfh3/behavioral3", "https://tria.ge/221025-gqnwyabfh3/behavioral2", "https://tria.ge/221028-y169psecbn/behavioral3", "https://tria.ge/221029-bjlv4sfcbr/behavioral15", "https://tria.ge/221029-bjlv4sfcbr/behavioral13", "https://tria.ge/221029-bjlv4sfcbr/behavioral8", "https://tria.ge/221029-bjlv4sfcbr/behavioral7", "https://tria.ge/221029-bj1z2afcdk/behavioral10", "https://tria.ge/221029-bj1z2afcdk/behavioral9", "https://tria.ge/221029-bj1z2afcdk/behavioral6", "https://tria.ge/221029-bj1z2afcdk/behavioral5", "https://tria.ge/221115-cpxegaee62/behavioral1", "https://tria.ge/221115-cpxegaee62/behavioral2", "https://tria.ge/230113-ctz16adf45", "https://tria.ge/230109-ywqq6aba3z", "https://tria.ge/230109-ywqq6aba3z/behavioral32", "https://tria.ge/230109-ywqq6aba3z/behavioral31", "https://tria.ge/230109-ywqq6aba3z/behavioral30", "https://tria.ge/230109-ywqq6aba3z/behavioral2", "https://tria.ge/230109-ywqq6aba3z/behavioral5", "https://tria.ge/230109-ywqq6aba3z/behavioral6", "https://tria.ge/230109-ywqq6aba3z/behavioral7", "https://tria.ge/230109-ywqq6aba3z/behavioral8", "https://tria.ge/230109-ywqq6aba3z/behavioral9", "https://tria.ge/230109-ywqq6aba3z/behavioral10", "https://tria.ge/230109-ywqq6aba3z/behavioral12", "https://tria.ge/230109-ywqq6aba3z/behavioral11", "https://tria.ge/230109-ywqq6aba3z/behavioral13", "https://tria.ge/230109-ywqq6aba3z/behavioral14", "https://tria.ge/230109-ywqq6aba3z/behavioral15", "https://tria.ge/230109-ywqq6aba3z/behavioral16", "https://tria.ge/230109-ywqq6aba3z/behavioral17", "https://tria.ge/230109-ywqq6aba3z/behavioral18", "https://tria.ge/230109-ywqq6aba3z/behavioral19", "https://tria.ge/230109-ywqq6aba3z/behavioral20", "https://tria.ge/230109-ywqq6aba3z/behavioral21", "https://tria.ge/230109-ywqq6aba3z/behavioral22", "https://tria.ge/230109-ywqq6aba3z/behavioral23", "https://tria.ge/230109-ywqq6aba3z/behavioral24", "https://tria.ge/230109-ywqq6aba3z/behavioral25", "https://tria.ge/230109-ywqq6aba3z/behavioral26", "https://tria.ge/230109-ywqq6aba3z/behavioral28", "https://tria.ge/230109-ywqq6aba3z/behavioral29", "https://tria.ge/230108-qvj8zshb3t/behavioral1", "https://tria.ge/230108-qskfzahb2y/behavioral12", "https://tria.ge/230108-qskfzahb2y/behavioral28", "https://tria.ge/230108-qskfzahb2y/behavioral27", "https://tria.ge/230108-qr6b2sdg22/behavioral1", "https://tria.ge/230108-qr6b2sdg22/behavioral2", "https://tria.ge/230108-qr1fssdf98/behavioral3", "https://tria.ge/230108-qr1fssdf98/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral1", "https://tria.ge/230108-qrv63sdf97/behavioral2", "https://tria.ge/230108-qrmvpsdf96/behavioral1", "https://tria.ge/230108-qrmvpsdf96/behavioral2", "https://tria.ge/230108-fvadnsgb8s/behavioral12", "https://tria.ge/230108-fvadnsgb8s/behavioral2", "https://tria.ge/230108-ftyd4sgb71/behavioral9", "https://tria.ge/230108-ftrlkagb7z/behavioral2", "https://tria.ge/230106-ryhp1ace8y/behavioral2", "https://tria.ge/230120-lncs4sad55/behavioral3", "https://tria.ge/230115-xqrwlaag69/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral6", "https://tria.ge/230115-x2h3tsbb49/behavioral32", "https://tria.ge/230115-x2h3tsbb49/behavioral28", "https://tria.ge/230115-x2h3tsbb49/behavioral26", "https://tria.ge/230115-x2h3tsbb49/behavioral14", "https://tria.ge/230115-x2h3tsbb49/behavioral10", "https://tria.ge/230120-1vxjesbg9t/behavioral1", "https://tria.ge/230120-1vxjesbg9t/behavioral2", "https://tria.ge/230102-s2ryhseg39/behavioral10", "https://tria.ge/230102-s3kktshh7t/behavioral2", "https://tria.ge/230102-s3v2kahh7v/behavioral2", "https://tria.ge/230102-s38bwshh7y/behavioral2", "https://tria.ge/230102-s4zq5seg44/behavioral32", "https://tria.ge/230102-s2n7maeg38/behavioral12", "https://tria.ge/230102-s2n7maeg38/static1", "https://tria.ge/230102-tekflaeg63/static1", "https://tria.ge/230105-xbxhjacg76/behavioral1", "https://tria.ge/230105-xbxhjacg76/behavioral2", "https://tria.ge/221221-zk1mnagd4x/behavioral3", "https://tria.ge/221221-zjmz6sdc27/behavioral3", "https://tria.ge/221221-zjjmradc26/behavioral3", "https://tria.ge/221221-zjezkagd3w/behavioral3", "https://tria.ge/221225-df32bseb6z/behavioral11", "https://tria.ge/221225-df32bseb6z/behavioral26", "https://tria.ge/221225-df32bseb6z/behavioral25", "https://tria.ge/221225-destzaeb6y/behavioral1", "https://tria.ge/221225-destzaeb6y/behavioral2", "https://tria.ge/221224-hvmp4shf85/behavioral2", "https://tria.ge/221224-hqfq1ahf77/behavioral1", "https://tria.ge/221224-hqfq1ahf77/behavioral2", "https://tria.ge/221221-zvhvlagd7y/behavioral3", "https://tria.ge/240331-yqk9gsaf9z/behavioral8", "https://tria.ge/240331-yqk9gsaf9z/behavioral9", "https://tria.ge/240129-m661cagdb6/behavioral2", "https://tria.ge/240129-lkztgaehh2/behavioral3", "https://tria.ge/240111-cahyjaccem/behavioral31", "https://tria.ge/240111-cahyjaccem/behavioral30", "https://tria.ge/240111-cahyjaccem/behavioral29", "https://tria.ge/240111-cahyjaccem/behavioral22", "https://tria.ge/240111-cahyjaccem/behavioral21", "https://tria.ge/240111-cahyjaccem/behavioral11", "https://tria.ge/240107-eq4w2sfch5/behavioral7", "https://tria.ge/240106-dbq6zafccm/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral3", "https://tria.ge/231224-3h4hbaefg7/behavioral7", "https://tria.ge/231224-g5gq6sbhb2/behavioral7", "https://tria.ge/231217-zztgwsfger/behavioral2", "https://tria.ge/231217-ysjtfahaf3/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral7", "https://tria.ge/231217-yscecsfefl/behavioral11", "https://tria.ge/231217-yl3mzafebp/behavioral7", "https://tria.ge/231217-yl3mzafebp/behavioral2", "https://tria.ge/231217-yjcc1afeap/behavioral7", "https://tria.ge/231217-yjcc1afeap/behavioral3", "https://tria.ge/240317-kz93babd61/behavioral7", "https://tria.ge/240317-kz93babd61/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral3", "https://tria.ge/240409-btvwrshh94/behavioral11", "https://tria.ge/231015-l3gqlsdg6w/behavioral8", "https://tria.ge/230324-hax1cacf74", "https://tria.ge/230324-g9c9jscf67/behavioral2", "https://tria.ge/230324-g8jd6seg41/behavioral3", "https://tria.ge/230321-gr8yhaha33/behavioral5", "https://tria.ge/230321-gr8yhaha33/behavioral10", "https://tria.ge/230321-gr8yhaha33/behavioral9", "https://tria.ge/230321-gr8yhaha33/behavioral6", "https://tria.ge/230321-grwyyaha29/behavioral7", "https://tria.ge/230321-grwyyaha29/behavioral16", "https://tria.ge/230321-grwyyaha29/behavioral15", "https://tria.ge/230321-grwyyaha29/behavioral13", "https://tria.ge/230321-grwyyaha29/behavioral8", "https://tria.ge/230321-f6rgbsah5x", "https://tria.ge/230321-f1p2bagh55/behavioral2", "https://tria.ge/230321-f1p2bagh55/behavioral3", "https://tria.ge/230313-jp94wsbb8x/behavioral2", "https://tria.ge/230308-zttwgaha65/behavioral2", "https://tria.ge/230308-zr5j7aha49/behavioral2", "https://tria.ge/230308-zp7xjaga2z/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral3", "https://tria.ge/230307-1xx8qsbg5v/behavioral4", "https://tria.ge/230307-1rdl5scc53/behavioral1", "https://tria.ge/230307-1f7e3scb88/behavioral4", "https://tria.ge/230307-1f7e3scb88/behavioral16", "https://tria.ge/230305-31dplshh79/behavioral2", "https://tria.ge/230305-31dplshh79/behavioral3", "https://tria.ge/230305-3s617ahd3s/behavioral2", "https://tria.ge/230305-3s617ahd3s/behavioral3", "https://tria.ge/230305-3snjvahh67/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral3", "https://tria.ge/230305-eckw1sff35/behavioral1", "https://tria.ge/230305-eb63vsfa61/behavioral3", "https://tria.ge/230305-eabwbsfa6z/behavioral2", "https://tria.ge/230305-eabwbsfa6z/behavioral3", "https://tria.ge/230305-d9lddafa6y/behavioral1", "https://tria.ge/230305-d9lddafa6y/behavioral2", "https://tria.ge/230305-d82c7sff27/behavioral3", "https://tria.ge/230305-d82c7sff27/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral1", "https://tria.ge/230305-d8rtrsff26/behavioral2", "https://tria.ge/230305-d62aesff25/behavioral1", "https://tria.ge/230305-d62aesff25/behavioral2", "https://tria.ge/230305-d4phvafe99/behavioral1", "https://tria.ge/230305-d4phvafe99/behavioral2", "https://tria.ge/230305-d4a1fsfe98/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral1", "https://tria.ge/230305-d33dbafa51/behavioral2", "https://tria.ge/230305-d21s4afe93/behavioral1", "https://tria.ge/230305-d21s4afe93/behavioral31", "https://tria.ge/230305-d21s4afe93/behavioral23", "https://tria.ge/230305-d21s4afe93/behavioral21", "https://tria.ge/230305-d21s4afe93/behavioral13", "https://tria.ge/230305-dyzrmafe89", "https://tria.ge/230305-dycl4afa5v/behavioral29", "https://tria.ge/230305-dycl4afa5v/behavioral27", "https://tria.ge/230305-dycl4afa5v/behavioral7", "https://tria.ge/230305-dycl4afa5v/behavioral15", "https://tria.ge/230220-pbc5wsah96/behavioral3", "https://tria.ge/230220-pbc5wsah96/behavioral2", "https://tria.ge/230215-baxk9ahc37/behavioral1", "https://tria.ge/230215-baxk9ahc37/behavioral2", "https://tria.ge/230204-rnp2bsgh3y/behavioral1", "https://tria.ge/230204-rnp2bsgh3y/behavioral2", "https://tria.ge/230204-qvwa9add55", "https://tria.ge/230204-qvlrtadd53/behavioral3", "https://tria.ge/230202-h81h5ahc9z/behavioral2", "https://tria.ge/230202-h81h5ahc9z/behavioral3", "https://tria.ge/230201-av97eabb24/behavioral2", "https://tria.ge/230127-v6q8wsdg5y/behavioral2", "https://tria.ge/230125-kn9meafe37/behavioral1", "https://tria.ge/230125-kn9meafe37/behavioral2", "https://tria.ge/230122-tqj9zaac8v/behavioral3", "https://tria.ge/230122-tqj9zaac8v/behavioral1", "https://tria.ge/230122-tqj9zaac8v/behavioral2", "https://tria.ge/231206-hwhgsacd32/behavioral1", "https://tria.ge/231206-hwsbzscd34", "https://tria.ge/231206-hwsbzscd34/behavioral1", "https://tria.ge/231206-hvz1facd27/behavioral1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1081", "name": "Credentials in Files", "display_name": "T1081 - Credentials in Files" }, { "id": "T1130", "name": "Install Root Certificate", "display_name": "T1130 - Install Root Certificate" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1042", "name": "Change Default File Association", "display_name": "T1042 - Change Default File Association" } ], "industries": [], "TLP": "white", "cloned_from": "661c5aeb351e7ed1fd41dccd", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2817, "FileHash-SHA1": 2698, "FileHash-SHA256": 2703, "domain": 65, "URL": 12, "hostname": 13, "SSLCertFingerprint": 1 }, "indicator_count": 8309, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "66 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "update.cat", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "update.cat", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780337328.6877356 }