Hello everyone, welcome back to another TikTok cap cut tutorial in this one.  The first method used to work very reliably, but it's not working as well anymore. So I'm going to show you a second version if the first one doesn't work. The first one's very easy. Go click at the bottom there. You'll see the circle and inside that circle, there's that little yellow logo thing. Click on that. And then the second step is to add to favorites. And when you do that, that is now part of your favorites library. It should sync up with cap cut, but in a lot of cases, it's not doing that anymore. So let me show you the backup version. The backup version, let me just show you what it sounds like. Yeah, that's Morky. He's a great little pupper. I follow him. I love that dog. I'm glad for him. Now the second step here is to hold your finger down on the video. And when you do that, you get the option to save the video. This is of course on the iPhone. Saving a video is also an option on the Android phone. So at the bottom left there, you're going to see that it's saying saving and I guess it's a longer video. So it'll take a few seconds. Once the video is saved, we're then going to import that audio in a different way to get it into cap cut. So here we go. 90% saved. Good. Presto. All right. Good stuff. Now, in order for us to move to the next step, we're going to go and click on other. And then I am going to go when I clicked on other, it gives me the option to save this video. So I'm going to click save video. And now it's on our phone. Cool. All right. So this video with Morky is on our phone. Let's close up TikTok. Let's go back into cap cut. I'm going to go click on new project. And then I'm going to go ahead and pick a video. I really like this one for reasons. But I think it's got audio. So I'm not going to click on that one. I'm going to click on this one with the puppy dog. All right. Cool. Got the dog. Now I want to add that audio in. How would I do that? I would click on add audio and then let's look at sounds. Now it is saved. It looks like as an original sound. So that's good news. So it did work. But what if it didn't work and we didn't get the sound that we wanted? I'm going to click on this little folder icon and then it says extract sound from video. I'm going to go click on that. And then the video is the last one here. So it's this one with little Morky. I'm going to go import sound only. So I selected the video. I click import sound only. And now you're going to see extracted bunch of numbers. But it says 16 seconds. If I click on it. That's little Morky's video. And that's his audio. So I'm going to click on this plus sound. And now that is added. So that's the backup second way to add it in. If the first way doesn't work. That's how you add audio into CapCut for video editing guys. Thanks for watching. Timer stuff coming up. Stay tuned.


crises there will continue to be. In meeting them, there is a recurring temptation to feel that some spectacular and costly action could become the miraculous solution to all current difficulties. But each proposal must be weighed in the light of a broader consideration, the need to maintain balance. Balance between the private and the public economy, balance between the cost and hope for advantages, balance between the clearly necessary and the comfortably desirable, balance between actions of the moment and the national welfare of the future. Good judgment seeks balance in progress. Lack of it eventually finds imbalance and frustration. The record of many decades stands as proof that our people and their government have in the main understood these truths and have responded to them well in the face of threat and stress. But threats new in kind or degree constantly arise. Of these I mentioned two moments. A vital element in keeping the peace is our military establishment. Until the latest of our world conflicts, the United States had no armaments industry. We have been compelled to create a permanent armaments industry of vast proportions. Now this conjunction of an immense military establishment and a large arms industry is new. The total influence, economic, political, even spiritual is felt in every city, every state house, every office of the federal government. We recognize the imperative need for this development. That we must not fail to comprehend its grave implications. In the councils of government we must guard against the acquisition of unwarranted influence whether sought or unsought by the military industrial complex. The potential for the disastrous rise of misplaced power exists and will persist. We must never let the weight of this combination endanger our liberties or democratic processes. We should take nothing for granted. Only an alert and knowledgeable citizenry can compel the proper meshing of the huge industrial and military machinery of defense with our peaceful methods and goals so that security and liberty may prosper together. A kin to and largely responsible for the sweeping changes in our industrial military posture has been the technological revolution during recent decades. In this revolution research has become central. It also becomes more formalized, complex, and costly. Today the solitary inventor tinkering in his shop has been overshadowed by task forces of scientists. In the same fashion, the free university, historically the fountainhead of free ideas and scientific discovery has experienced a revolution in the conduct of research. For every old blackboard there are now hundreds of new electronic computers. Yet in holding scientific research and discovery in respect we must also be alert to the equal and opposite danger that public policy could itself become the captive of a scientific, technological elite. It is the task of statesmanship to mold, to balance, and to integrate these and other forces new and old within the principles of our democratic system, ever aiming toward the supreme goals of our free society. Another factor in maintaining balance involves the element of time. As we peer into society's future, we, you and I, and our government, must avoid the impulse to live only for today, plundering for our own ease and convenience the precious resources of tomorrow. We cannot mortgage the material assets of our grandchildren without risking the loss also of their political and spiritual heritage. We want democracy to survive for all generations to come, not to become the insolvent fan of tomorrow.


Welcome to Memanalysis for Hedgeshrocks. Today we are looking at a sample that has a native unpacking style that is .NET file size. We are going to formulate a plan to unpack this file using Tiny Tracer to log the APIs and then see where we can break on to unpack it with x64dbg. After unpacking it, we are going to de-opfuscate the style. Let's look into it. I would like to show you how to unpack this sample and how to analyze it. When you take a look at it, this is a Visual CC++ application probably made for Visual Studio 2008 to 2010. We are also going to check on Potex Analyzer and on the strings. I'm going to quickly create a strings view. Firstly, when checking the strings, you will see that there isn't much. This is just the standard stuff that you also find and probably find the execution environment in the library or whatever and then you have the imports. That's basically it. The version info, well, that one looks pretty weird. It's just like someone opened a dictionary and randomly picked some words and put them into the version info. The good thing about that is that it's very suspicious if you find that on your system with random words and version info. You know it's never. The strings below the version info, they look encrypted. This is what encrypted strings look like. There isn't much else. The rest just looks the same as these strings. Again, version info pretty weird. Visualization shows there isn't high entropy there but still we suspect it's encrypted simply because of the lack of strings and the lack of stuff you can see there. Plus, when you check the imports, the anomalies section will also tell you that there are some functions that are typical for code injection and these are functions we can use to break on to unpack this file. There's nothing else special here, I guess. Let's analyze the behavior of this sample now using Tiny Tracer. This will take a while. First, I'm going to rename it and I'm going to use Tiny Tracer by Hashi Risade and then run it as administrator. It will run for some time and now we are going to wait until it's finished. Tiny Tracer has finished finally and we can check the result. It's in sample exa.tag and here it is. Let's scroll through a bit. Let's actually search for the functions that we found like virtual protect. We definitely will break on this function. Furthermore, we will also break on load library because this seems to be an interesting marker. We see here that mscoree.el is loaded with core ex main and that means the file that is unpacked is a .NET executor and here the execution of core ex main starts. I want to know when we are almost there so we will put a break point on create thread as well. We got this maybe also virtual alloc. That looks like a good outline for me. This is my plan. Let's open up the sample in x32dbg. Now that we made our plan, let's place the break points on these functions that we marked here. Load library A, virtual protect and create thread. Now we can press run and we add the address of entry point, run again and that's the first call to virtual protect. First argument is the address of the area where virtual protect is called and also if this is 40, it means that this is going to be made executable and we can follow this in DOM, so nothing special so far. If you look at the memory map, this area is the data section of our sample which is already quite interesting but we have a few more calls to go. We are probably going to dump it here or here. So let's continue with run. That's the load library call. I'm going to press on run to user code because then we can see here, okay, this is MsCurry. That's correct. We are actually here at this point of the execution. Let's run again and use the next virtual protect call that should be this one and the address is this one. So let's follow in DOM that is somewhat here. What area is this? It was that one, I think. It's five, two, two. So that should be the correct area. Let's look in the memory following DOM and you see here is a polybex executable file inside that area. So that is very good. We are on the right track but let's check the other ones as well. Next virtual protect call and it's five, four, six thousand. So that seems to belong to this area as well. So it's still in this area. And again, and now we are at the third virtual protect call and it's also still in this area. See here if you scroll a bit here. It says agnian.pdb. So this seems to be the .NET file that we want. And since we are here now, let's dump this. So we know it's this area.  So here is our sample. Of course, first thing we know it's .NET. That's attempt to open it in the inspire. And of course, it doesn't work. Let's investigate why. Now the obvious ones when you just dump the file from memory is you need to unmap the file and need to fix the imports or anything like that. And indeed in this case, I don't see any imports. So there is a data directory. There's an import table, but it seems that the imports cannot be read or are not valid or whatever most of the time. And this is because the file still needs to be unmapped. So I'm using PE unmapper by Hashirisada. And we want to unmap this dump. Conveniently, the dump contains the base. So we just need to retype it. So now we have created an unmapped version. And we can check if it's now recognizing the imports. And indeed now we have the standard import for .NET executable. Let's open this file in the inspire. So that was the first one we couldn't read. And here it can read the code. Agniana, I'm not sure how to pronounce it. But this is obfuscated. So first thing I'm always trying when it looks like that is d4. Where is d4. I think I have it in my tools section. So I'm just drag and drop it into d4. Now we get a cleaned version of this dump. That looks a little bit better, but not actually because we have still no readable reference strings. So if you check that funnily enough, I immediately recognize this function as being the XOR obfuscation by draconia. So let's decode this. This is actually easy because such a string decryption function, you can just provide the token to d4. To create a version with the decoded strings. So that is relatively easy and we can do that. So you need to provide a sample. Then we say the string type is delegate. And let's provide this token. The token is the one from the string encoding function. So it's 60000DB. Let me remove the clean dump because sometimes it makes some issues. And now we created a dump where the strings might be decrypted. And indeed the strings are decrypted now and we can read. See here we can read what's going on a little bit better. Still we need to identify what these functions actually do. But that shouldn't be a problem anymore. I mean the unpacking worked now. This seems to be called AgaNiana. And let's see if we find the configuration actually. It says something like get config. If you click on that you see it contacts the C2 to get the current config. So we can actually rename that. Because where does it take this string from when you check that? That seems to be some code. And that is this ID here. So it says ID is. But here we have the version. Alright so what I want to know is where is this request for the configuration sent to. So we can maybe also get our own config. And the easiest way to do that is just set a break point here. Because yeah. At a break point we say start okay. And it's warning us because the fire doesn't have a valid extension I don't care. Alright. And what do we see here? Let's step over. And now we have the first part of this. Of this here. If you want the full config string I guess we can just break point here. Continue. And here it is. This would be the full request string that is sent to the C2. I have entered this request string to virus total. And that is what I get. So here's the content of the file and that's what it looks like. So we have txt.dog.x wallet seed. And that's it. So now we know what we get from here. Let's stop debugging. And I'm gonna go back to the start of that. So we know this is this URL string. And there's one thing I should have done first actually after cleaning the dump. And that is look at the strings. Oh wait. So again we see here still the encrypted strings. And if you scroll to the US stream of the .NET executable we have the decoded versions because we decoded them with the before dot. And that is where you see or get an idea what this file is actually doing. Let's scroll a little bit make this bigger. So this we have seen this right. And here you see it's containing typical stealer strings to steal a lot of credentials. And there's the log file header agony on a stealer. And you see also some info threads where you can find more information because this helps you to get like a good overview to everything. And yeah. Let's see what it does. And main here. So it splits this config right. And this is the config we know that by now. Config. This config is split here and then it checks this for one. The presence of one. And in this class here there are a lot of methods related to anti debugging stuff. So anti debug this checks the IP. Some sleeping methods some check for the presence of process names related to reversing. And here we have signs from the management object searcher that this is in a sandbox. So some anti sandbox stuff. So did I forget something? I forgot this one. Now if you go back to main the code will make more sense. Since now you know okay it splits this config and then checks the values and checks if any of these are true and then it executes those anties. And then more is going on. I will stop here because this will otherwise make a very long video. But I think you get the idea. So we just unpacked a file that seemed to be a native file. I mean it was a native file but it's a picker that allows loading dot net files without being a dot net stuff itself. And that was quite interesting. You can unpack those just as any other native picker though. And using DE for dot we were able to decrypt most of the strings. That's it if you have any questions please leave them below and see you next time.


Well, it happened once again both Joe Manchin and Kirsten Sonoma were confronted in public by their constituents and This is really important. Even if they don't necessarily budge whenever an activist approaches them I do still think that it's important to showcase this because direct pressure is I think The best form of activism when you are in the ear of a politician and you directly make your case to them and put pressure on them Now before I show you the first video, which is of Joe Manchin being confronted by a climate activist I want to give you a little bit of context because there are five climate activists who have been on a hunger strike outside of the White House Now for days urging the Democratic Party to take action on a climate change and not allow People like Joe Manchin to water down the Build Back Better Act So what you're gonna see is one of these climate activists who is on a hunger strike They had an opportunity to confront Joe Manchin and as you're gonna see he kind of engages with them He tries to placate them and set up an appointment, which you know, they expect him to not get back to them But take a look at what happens here We can't get in a meeting we've been calling we're trying to get a meeting So watching that was incredibly disheartening but yet I mean his response was predictable He had no concern for the future that he is depriving this young person of and He constantly just tried to reiterate look call my office will set up a meeting They knew that he was just trying to get them off of his back He had no interest in actually engaging further with this individual It's just when you're put on the spot and there are cameras in your face You want to try to find some way to make the yelling and the pressure stop But they know that they had that limited window of opportunity and once it's gone. It's never coming back He's not gonna meet with them. So, you know, um that person said I'm going to grow up in a catastrophic climate emergency if you continue to block the civilian climate core and Really, they made a strong case for their own survival and to see Joe Manchin not really care Again, not surprising in the slightest, but they said I have dreams young people have dreams. I want to live young people want to live and You know, he tried to deflect and bring up the emissions of Asia We're not in Asia. We can't control what governments in Asia do we can control what our government that's supposed to be representing us does and What makes this entire situation even more disheartening is when you consider the fact that Democratic Party loyalists more centrist neo-liberal figures like Sally Albright was actually making fun of these young people going on strike Over climate change.  Increasing fascism due to the refugee crises that climate change is going to inevitably cause It's just I have no time for these people who are dismissing these climate activists Now I know what you're thinking that what Joe mentioned did there that was really it was cold He was overly dismissive. He obviously tried to placate them and he was seemingly distant, but that is actually Preferable when you juxtapose that interaction with this interaction that we're going to see when Kirsten cinema was approached in an airport while she was having a conversation with Tim Scott and She was much much worse when it comes to her response or lack thereof I Can have them meet you next People are suffering your constituents are suffering. What are you gonna do about climate change next week in Glasgow could be the last chance Please answer me senator my family my house ever come to this on working situation That man at the end that thanked Tim Scott That really I don't know what it was about that but it triggered me it it's bleak shit, right? It made me go even more doomer. I mean Tim Scott is a Republican politician. He's a corporatist What are you thanking him for? Standing up to Democrats when it comes to this manufactured culture war that the Republican Party is propagating this because they're trying to distract you from the real issues It's just awful, but I mean getting to the real subject here Kirsten cinema She refused to even acknowledge that person who was making a pretty compelling case as to why maybe you should have a Conversation with us because it's really easy to get a hold of you if we donated lots of money to your campaign But Kirsten Sonoma didn't even acknowledge her existence and the only time when Kirsten Sonoma did acknowledge her She said don't touch me You can see that she didn't touch Kirsten Sonoma in that video that was obvious But I think maybe her arm or her hand brushed up against Kirsten Sonoma and immediately Kirsten Sonoma just recoils She doesn't want any peasant germs on her the fact that they're breathing her airspace is offensive to her I mean Kirsten Sonoma is just one of the worst and what this person is saying Isn't controversial. Hey meet with us in the same way you meet with corporate lobbyists and your donors Maybe have a conversation with your constituents that person is a constituent of Kirsten Sonoma and she said you know, I Want to make sure that we do something about climate change your constituents are suffering What are you gonna do about climate change and next week in Glasgow could be the last chance that we have and You know, the only response that we get from Kirsten Sonoma with regard to the substance aside from her saying don't touch me is Sorry about that, but she says this to Tim Scott It's just it's awful and since we're talking about Kirsten Sonoma and her being confronted in public I've got to give you an update that's gonna make you feel even worse about this situation Because you'll probably recall the bathroom protesters at ASU Well, it turns out the situation has gotten worse But not for Kirsten Sonoma for the protesters who dared to ask her to Help them which is what she was elected to do after they got her elected Caroline Vakil of the Hill reports Police from Arizona State University where cinema teachers are recommending that four people involved in the incident Received misdemeanor charges related to disruption of an educational institution and disorderly conduct the Arizona Republic reported Adam Wolf a spokesperson for the university's police told the Hill in a statement that the ASU police department has completed its Investigation and submitted charges to the Maricopa County attorney's office So because they dared to ask Kirsten Sonoma questions Persistently, but this is a lawmaker because they dared to ask her questions now. There's this recommendation of charges Now Kirsten Sonoma Hated this she put out a statement basically trying to make it seem as if her students were victimized when that's clearly not the case But if Kirsten Sonoma had even a shred of decency in her She would come out and denounce this and say listen, I understand that emotions are high there's a lot at stake and I don't approve of what these protesters did following me into the bathroom was too much I don't appreciate that but I don't want them to be prosecuted That's the least that she can do if she were a half decent person but we know she's not gonna do that because she wants any peasant who dare challenge her publicly to Go away if they have to be jailed. So be it. This is truly the worst of the worst So between Kirsten Sonoma and Joe Manchin Substantively, they're both they're both horrible. They're equally culpable in killing this agenda The Democratic Party was united in getting through but now they've watered it down and they're still being smug and Elitist as they do it but Kirsten Sonoma Somehow just finds a way to go above and beyond in her cruelty and doesn't even try to placate the person who's trying to have a Conversation with her. I mean what Joe Manchin does it's not enough But to even attempt to converse with someone that shows that you at least have the bare minimum Recognition of that person's humanity, but Kirsten Sonoma won't even go that far So, I mean, yeah, I assume that these public confrontations are going to continue to happen So long as they're necessary because when you cut off the line of communication between you and your constituents They're gonna have to find alternative ways of reaching you and this is one of them and guess what? It's effective it gets your attention. So they're gonna keep resorting to this so long as you keep ignoring them