Scans for browser extensions and local files related to cryptocurrency wallets (e.g., MetaMask, Binance).
Outbound traffic to api.telegram.org or specific suspicious IP addresses associated with "Onusman" hosting. Onusman_2022-10-31_update.zip
Checks for virtual environments (VMWare, VirtualBox) and debugger presence to prevent analysis by security researchers. Scans for browser extensions and local files related